BeyondTrust Remote Support flaw: what CISA says to patch, hunt and rotate

What CISA says about the flaw

This guide uses only what CISA's published alerts say. Where CISA gives a requirement or an action, the wording follows the alert as closely as plain English allows.

In its alert dated October 16, 2026, CISA says the critical authentication bypass vulnerability CVE-2026-102764 affects BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier.

CISA states that cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally.

CISA says it added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on October 16, 2026.

A separate CISA alert of the same date announces two KEV additions. It lists a Fortinet path traversal vulnerability, CVE-2025-61624, and describes the BeyondTrust flaw as an authentication bypass by spoofing vulnerability.

Who needs to act, and on which versions

The answer depends on how your team runs Remote Support. CISA's alert separates self-hosted appliances from the vendor-hosted service, and the two groups face different work.

CISA says patches are available for supported versions, 24.3.1 and later, and that organizations using older versions must upgrade first.

CISA directs its immediate action list to organizations with affected self-hosted Remote Support appliances.

For BeyondTrust-hosted (SaaS) deployments, CISA says no patching work remains, because they have already been patched.

Everything below applies to the self-hosted group.

Patch and reduce exposure

CISA's first instruction is to apply the BT26-05-RS patch, as set out in BeyondTrust's Security Advisory BT26-05.

CISA also asks self-hosted operators to narrow who can reach the appliance. It says to limit external access to the services needed to support users and customers.

It adds a second network step for the administrative side of the product.

CISA's alert on the KEV catalog explains why a listing carries weight. It says Binding Operational Directive (BOD) 26-04 requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities.

That directive covers only federal civilian agencies. CISA nonetheless says it encourages all organizations to adopt risk-based vulnerability management and to prioritize remediation of KEV catalog vulnerabilities.

Check whether you were compromised

Patching closes the flaw but does not tell you whether someone used it before the fix. CISA addresses that gap directly.

CISA says organizations with affected self-hosted appliances should conduct network and memory forensics to identify evidence of potential compromise.

For the hunt itself, CISA lists what to look for: unrecognized privileged or administrative sessions, unrecognized script files, unexpected gaps in logs or log forwarding, and unauthorized account, permission, or session-policy changes.

CISA's KEV alerts note that BOD 26-04 sets basic expectations for when federal agencies must check whether threat actors compromised a system before the patch was applied.

CISA also points readers to a Mandiant blog on this exploitation. It says the blog offers additional hunt and isolation guidance and detections.

If you suspect a compromise

CISA's steps here run in a set order: contain the appliance, preserve evidence, then rebuild.

It tells organizations to isolate any suspected or confirmed compromised appliances. It then says to snapshot virtual appliances or take a forensic image of physical ones, forward appliance syslog and session events to the SIEM immediately, and collect further logs such as web application firewall, reverse-proxy or perimeter firewall logs for the exposure window.

For the rebuild, CISA says to rebuild from a known-good state and apply the BT26-05-RS patch.

The evidence steps come before the rebuild in CISA's list. The alert places the snapshot and log collection ahead of the rebuild, and a team following the list in order would do the same.

Credentials, sessions and privileged access

The last part of CISA's guidance deals with what a remote-access appliance holds and what it can do on your network. It is the part most relevant to handling privileged tools in general.

After the rebuild and patch, CISA says to rotate every credential the appliance stored or injected, revoke all active support sessions, and review new multifactor authentication registrations on privileged accounts.

CISA also refers readers to BeyondTrust's B Series Appliance on-premises security guidance. It says the guidance covers securing network connectivity for self-hosted Remote Support appliances.

Read together with the hunt list above, the scope of CISA's instructions is plain. They cover credentials, live sessions, multifactor registrations, administrative access, session policies and log forwarding, and they sit alongside the patch itself.

What the documents do not cover

This guide was written from CISA's alerts alone. It does not reproduce BeyondTrust's advisory, BeyondTrust's blog, or the Mandiant write-up, so version-specific patch steps and detection details belong to those sources, which CISA points readers to.

The documents also give no general policy for privileged remote-access tools beyond this product. Anything on that subject in this guide is limited to what CISA names for this vulnerability. Teams that want to go further should take that direction from CISA's linked resources and the vendor's own advisory, not from this summary.