CISA Urges Patching Critical security flaw in BeyondTrust Remote Support

What happened

Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. CISA added CVE-2026-102764 (the public catalogue number for a specific software flaw) to its Known Exploited Vulnerabilities (KEV) catalog on Oct.

Organizations on a self-hosted Remote Support version older than 24.3.1 will need to upgrade to a newer version to apply the patch. CISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier.

Cyber threat actors (the person or group behind an attack) are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA urges organizations with affected self-hosted Remote Support appliances to immediately take the following actions: Apply the BT26-05-RS patch, as outlined in BeyondTrust’s Security Advisory BT26-05 .