CISA Urges Immediate Patching of Actively Exploited BeyondTrust Remote Support Vulnerability
Summary
CISA says attackers are exploiting CVE-2026-102764, an authentication bypass in BeyondTrust Remote Support versions 26.2.3 and earlier. It urges affected self-hosted users to patch, investigate for compromise, and rotate stored credentials.
Key points
- CVE-2026-102764 affects BeyondTrust Remote Support versions 26.2.3 and earlier; CISA added it to the Known Exploited Vulnerabilities catalog on Oct. 16, 2026.
- Attackers are exploiting the flaw for initial access, persistence, privilege escalation, and lateral movement.
- Apply the BT26-05-RS patch. Self-hosted installations older than version 24.3.1 must upgrade before they can patch; BeyondTrust-hosted SaaS deployments have already been patched.
- CISA urges affected organizations to restrict external and administrative access and investigate appliances for signs of compromise.
- If compromise is suspected, isolate the appliance, preserve forensic images and logs, and investigate for suspicious sessions, scripts, log gaps, and unauthorized account or policy changes.
- After rebuilding from a known-good state and patching, rotate credentials stored or injected by the appliance, revoke active support sessions, and review new MFA registrations on privileged accounts.
Article Details
- Vulnerability Types
- Authentication bypass
- Severity
- Critical
- Affected Versions
- BeyondTrust Remote Support 26.2.3 and earlier
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Limit external access to the Remote Support appliance to services needed to support users and customers.
- Restrict access to administrative interfaces to trusted networks.