CISA Adds Actively Exploited Authentication Bypass Flaw in BeyondTrust Remote Support to KEV Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. The vulnerability is an authentication bypass flaw affecting BeyondTrust Remote Support (formerly Bomgar) self-hosted appliances versions 26.2.3 and earlier.

BeyondTrust has released patch BT26-05-RS as outlined in Security Advisory BT26-05. Supported self-hosted versions 24.3.1 and later can apply the patch directly. Organizations using versions older than 24.3.1 must upgrade to a supported version before applying the patch. BeyondTrust-hosted (SaaS) Remote Support deployments have already been patched.

CISA reports that cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally within compromised networks. The agency urges organizations with affected self-hosted appliances to immediately apply the patch, restrict external access to the appliance, and limit administrative interface access to trusted networks.

Organizations suspecting compromise are advised to isolate affected appliances, collect forensic snapshots, forward syslog and session events to SIEM, and rebuild from a known-good state after patching. All stored credentials, active support sessions, and multifactor authentication registrations on privileged accounts should be rotated and revoked.

CISA also recommends reviewing Mandiant’s blog ARMORY CASTLE Exploits BeyondTrust for additional detection and hunt guidance. The advisory was released on October 16, 2026.