BeyondTrust Remote Support Under Active Exploitation: Patch, Hunt, Rotate

What CISA is warning about #

Remote support appliances sit in a privileged position. They broker sessions between support staff and the systems they manage, so a flaw that lets an attacker skip authentication can turn one internet-facing box into a path deep into a network. CISA's October 16, 2026 alert describes exactly that risk for CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support | CISA, which concerns CVE-2026-102764 in BeyondTrust Remote Support, formerly known as Bomgar.

The agency states that the flaw affects versions 26.2.3 and earlier, and that cyber threat actors are actively exploiting it. According to the alert, attackers are using the vulnerability to gain initial access and then establish persistence, escalate privileges, and move laterally. This is not a theoretical exposure note. It is an active intrusion pattern with a clear sequence, and defenders should read the response guidance with that sequence in mind.

The same day, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. The companion alert, CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA, lists CVE-2026-102764 as "BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability." Its inclusion in the KEV catalog is the agency's formal signal that evidence of exploitation exists and that remediation should be treated as urgent.

Key facts #

• CISA issued its alert on October 16, 2026, describing CVE-2026-102764 as a critical authentication bypass.
• The affected product is BeyondTrust Remote Support (formerly Bomgar), in versions 26.2.3 and earlier.
• Patches are available for supported versions, which CISA gives as 24.3.1 and later. Organizations on older versions must upgrade before they can apply the patch.
• The fix is the BT26-05-RS patch, outlined in BeyondTrust's Security Advisory BT26-05.
• BeyondTrust-hosted (SaaS) Remote Support deployments have already been patched, according to CISA.
• CISA added CVE-2026-102764 to the KEV catalog on October 16, 2026.
• CISA recommends network and memory forensics, log forwarding to a SIEM, and a rebuild from a known-good state where compromise is suspected.

Why it matters #

An authentication bypass removes the first barrier between an attacker and a privileged function. In the case of a remote support appliance, the value to an attacker is not only the appliance itself. These systems often hold credentials, inject them into sessions, and provide a trusted channel into internal assets. CISA's guidance reflects this: after rotating the appliance's own secrets, defenders must also review what the appliance stored or injected, since those credentials may be exposed.

The attack chain described by CISA also explains why the response has several stages. Initial access is only the entry point. Once an attacker has a foothold, the alert says they establish persistence, escalate privileges, and move laterally. Patching closes the door, but it does not evict an intruder who already came through. That is why CISA pairs the patch instruction with instructions to investigate, isolate, and rebuild.

There is also a prioritization dimension. The KEV listing puts this flaw in the category that federal guidance treats as most urgent. The companion alert explains that Binding Operational Directive (BOD) 26-04 requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities listed in the KEV catalog on publicly exposed assets that grant total control of the asset post-exploitation. A self-hosted remote support appliance that is reachable from outside and controls access to internal systems fits that profile closely, which is why the response should not wait for a routine patch cycle.

Finally, the timing matters for forensics. CISA asks organizations to collect logs for the exposure window, meaning the period during which the vulnerable system was reachable. Logs that are not forwarded off the appliance, or that roll over before anyone looks at them, may be lost. Every hour spent without log forwarding is an hour of evidence at risk.

Who is affected #

The direct exposure is to organizations running self-hosted BeyondTrust Remote Support appliances at versions 26.2.3 and earlier. CISA's language is specific: the guidance targets "organizations with affected self-hosted Remote Support appliances." Organizations using the BeyondTrust-hosted SaaS deployment are described as already patched, so their primary task is confirming that their configuration matches that description rather than running the full self-hosted response.

Organizations on very old releases face an extra step. CISA states that deployments older than 24.3.1 must upgrade to a newer version before they can apply the patch. Teams in this position should plan for a version upgrade as a prerequisite, not a simple patch install, and should treat the upgrade path as part of the incident response timeline.

Federal Civilian Executive Branch agencies have additional obligations. The KEV alert notes that BOD 26-04 applies to these agencies and sets expectations for when they must check whether threat actors compromised a system before the patch was applied. The alert also says CISA encourages all organizations, not only federal ones, to adopt risk-based vulnerability management and prioritize KEV catalog vulnerabilities. Non-federal organizations are not bound by the directive, but the logic behind it applies to them equally.

Security operations teams, incident responders, and administrators who manage privileged access are the practical audience. They must handle the patch, the log collection, the hunt for suspicious activity, and the credential rotation. The work crosses several teams, so ownership should be assigned before the first step begins.

Immediate actions for affected appliances #

CISA's first instruction is to apply the BT26-05-RS patch, following BeyondTrust's Security Advisory BT26-05. The sequence matters. Because older versions must be upgraded before the patch can be applied, administrators should confirm the current version of every appliance first. Inventory is the step that most often gets skipped under pressure, yet it determines whether the patch is a quick fix or a multi-stage project.

Exposure should be reduced at the same time. CISA urges organizations to limit external access to the Remote Support appliance to the services needed by users and customers, and to restrict access to administrative interfaces to trusted networks. These steps narrow what an attacker can reach while patching is underway. They are not a substitute for patching, but they reduce the window in which an unpatched appliance can be targeted.

CISA also points to BeyondTrust's B Series Appliance on-premises security guidance for additional help securing network connectivity. Teams should read that material alongside the advisory, since network placement and access controls are part of the defensive picture.

Finally, organizations with affected appliances should begin forensic work even if they see no obvious sign of compromise. CISA recommends network and memory forensics to identify evidence of potential compromise. The alert treats this as a standard step for affected systems, not only for systems already known to be breached.

If you suspect compromise #

CISA's guidance for suspected compromise is detailed and sequential. The first step is isolation. Any suspected or confirmed compromised appliance should be isolated. Isolation should happen before analysts begin deeper work, so the system cannot be used to reach other assets while investigation proceeds.

Next, preserve evidence. CISA recommends collecting a snapshot of virtual appliances or a forensic image for physical appliances, so future forensics remain possible. The agency also advises immediately forwarding appliance syslog and session events to a SIEM, and collecting any other logs for the exposure window. Those include web application firewall logs, reverse-proxy logs, and perimeter firewall logs. The alert directs teams to BeyondTrust's Syslog guide for details on forwarding appliance logs and session events.

Then investigate. CISA asks teams to conduct network and forensic investigations and to hunt for specific indicators. The alert lists several categories to check:

• Unrecognized privileged or administrative sessions.
• Unrecognized script files.
• Unexpected gaps in logs or log forwarding.
• Unauthorized changes to accounts, permissions, or session policies.

Gaps in log forwarding deserve particular attention. An attacker who understands how an appliance records activity may try to disrupt that recording. A silent gap is therefore a finding in its own right, not merely a logging problem.

CISA also references Mandiant's blog post on the exploitation activity, which the alert describes as offering additional hunt and isolation guidance and detections. The alert names the post as "ARMORY CASTLE Exploits BeyondTrust." Teams should use it as a supplement to CISA's instructions, while checking that its guidance matches their own environment and versions.

Recovery and credential hygiene #

CISA's recovery order is specific. Rebuild from a known-good state and apply the BT26-05-RS patch. A rebuild matters because an attacker who achieved persistence may have altered the appliance in ways that a simple patch will not reveal. Patching a compromised system and returning it to service is not the same as recovering it.

After the rebuild, CISA recommends rotating every credential the appliance stored or injected. This is a broad instruction. Any secret that the appliance held or passed along to sessions should be treated as potentially exposed. The alert also asks teams to revoke all active support sessions, so that no session established before remediation continues to provide access.

Multifactor authentication deserves attention as well. CISA advises reviewing new multifactor authentication registrations on privileged accounts. An attacker who gains privileged access may register a new authentication factor to keep control of an account, so a review of recent registrations is a sensible check after a suspected compromise.

The recovery phase should end with documented evidence. Teams should be able to show which versions were running, when the patch was applied, which credentials were rotated, which sessions were revoked, and what the hunt found. This record supports both internal accountability and any later review by leadership or regulators.

Limits of the available information #

The sources provided here are CISA's alerts and the BeyondTrust and Mandiant references those alerts name. They establish the affected versions, the patch path, the exploitation pattern, and the recommended response. They do not provide technical details of the exploit itself, a full list of indicators of compromise, or an independent assessment of how widely the flaw has been used. Readers should not assume details beyond what CISA states.

For that reason, the most reliable next steps are the ones CISA lists directly: confirm your version, patch or upgrade, reduce exposure, forward logs, hunt, and rebuild where compromise is suspected. Pair those steps with BeyondTrust's advisory and Mandiant's hunt guidance, and verify each claim against your own telemetry before closing the incident.