CISA on BeyondTrust Remote Support: patch, hunt and contain CVE-2026-102764

What CISA said on October 16, 2026

CISA published an alert titled "CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support" on October 16, 2026. This briefing uses only CISA's pages, and they do not name the threat actors or say when exploitation began.

The alert says CISA is aware of a critical authentication bypass vulnerability, CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier.

According to CISA, cyber threat actors are actively exploiting the flaw to gain initial access, and then establish persistence, escalate privileges and move laterally.

CISA also states that it added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on October 16, 2026.

The practical reading is that this is not a flaw to schedule for a later maintenance window. CISA's own wording asks for immediate action by organizations that run the affected self-hosted appliances.

Patch: who needs to act and how

The patch path depends on the version you run and on who hosts the product. CISA's alert says patches are available for supported versions, which it identifies as 24.3.1 and later, and that organizations using older versions must upgrade first.

CISA tells organizations with affected self-hosted Remote Support appliances to apply the BT26-05-RS patch described in BeyondTrust's Security Advisory BT26-05.

For appliances older than 24.3.1, CISA states that the organization must move to a newer version before it can apply the patch.

Customers on the vendor's cloud service have no patching step. CISA's alert says BeyondTrust-hosted (SaaS) Remote Support deployments have already been patched.

CISA also points readers to a BeyondTrust blog post titled "ARMORY CASTLE and BT26-05: What Security Teams Need to Know" for detail on the vulnerability and the recommended response. That post is a separate document and was not part of the material used for this briefing.

Limit exposure of the appliance

Patching is one control. CISA's alert adds two network controls for self-hosted Remote Support appliances, and both apply whether or not you have patched yet.

First, CISA tells organizations to limit external access to the appliance to the services needed to support users and customers.

Second, CISA says to restrict access to administrative interfaces to trusted networks.

For more on network connectivity, CISA refers readers to BeyondTrust's guidance titled "B Series Appliance on-premises security." These two steps are the ones the alert gives for reducing exposure. It does not extend them to other remote-support or privileged-access products by name, so any wider review of those tools is a decision for your own team.

Check for compromise

Exploitation is under way, so a patched appliance may still have been compromised earlier. CISA says organizations with affected self-hosted appliances should conduct network and memory forensics to identify evidence of potential compromise.

The alert lists what to hunt for. CISA names unrecognized privileged or administrative sessions, unrecognized script files, unexpected gaps in logs or log forwarding, and unauthorized account, permission or session-policy changes as indicators of threat actor activity.

CISA also recommends reading Mandiant's blog "ARMORY CASTLE Exploits BeyondTrust" for additional hunt and isolation guidance and detections.

The list is short and specific. A team can turn each item into a query against appliance logs, session records and identity systems.

If you suspect a compromise

CISA gives a sequence of steps for organizations that suspect a compromise. The first is containment: isolate any suspected or confirmed compromised appliances.

The second is evidence. CISA says to collect a snapshot of virtual appliances, or a forensic image for physical appliances, so that forensics can be done later.

CISA adds that teams should immediately forward appliance syslog and session events to the SIEM. It also says to collect additional logs, such as web application firewall, reverse-proxy or perimeter firewall logs, for the exposure window.

The third step is recovery. CISA says to rebuild from a known-good state and apply the BT26-05-RS patch.

After the rebuild, CISA says to rotate every credential the appliance stored or injected, revoke all active support sessions, and review new multifactor authentication registrations on privileged accounts.

The order matters. Isolation and evidence collection come before the rebuild, so the rebuild does not erase the material needed for the investigation.

Why the KEV listing matters

A second CISA alert, also dated October 16, 2026, adds two vulnerabilities to the KEV Catalog. One of them is CVE-2026-102764, which CISA describes as a BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability.

That alert explains the federal rule behind the listing. CISA says Binding Operational Directive (BOD) 26-04 requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation.

The directive also covers compromise checks. CISA says BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

Private-sector teams are not bound by the directive, but CISA says it wants them to follow the same approach. CISA states that BOD 26-04 applies only to Federal Civilian Executive Branch agencies, and it encourages all organizations to adopt risk-based vulnerability management.

The BeyondTrust alert also points readers to CISA's BOD 26-04 implementation guidance to help prioritize remediation. For a self-hosted Remote Support appliance, CISA's instructions come down to three actions: patch, check for compromise, and limit network access.