US Cyber Agency Says Attackers Are Using a BeyondTrust Flaw to Get Into Networks
The US Cybersecurity and Infrastructure Security Agency said on Oct. 16, 2026, that attackers are actively exploiting a critical flaw in BeyondTrust Remote Support, and added it to its catalog of vulnerabilities known to be exploited. The agency lists the flaw as CVE-2026-102764, an authentication bypass that gets an attacker past the product's login, and says it affects versions 26.2.3 and earlier of the software, which was formerly sold as Bomgar.
A patch exists, though which route a customer takes depends on the version they are running. CISA says BeyondTrust has patched supported versions from 24.3.1 onward, so an organization on an older self-hosted appliance has to upgrade before it can apply the fix. Deployments on BeyondTrust's own hosted service have already been patched.
CISA urges organizations with affected self-hosted appliances to apply the BT26-05-RS patch immediately, following BeyondTrust's security advisory BT26-05, and says the attackers are using the flaw to gain initial access to networks.
Beyond the patch, the agency asks organizations to limit external access to the appliance to the services they need for supporting users and customers, to restrict administrative interfaces to trusted networks, and to look for evidence that an affected appliance has already been compromised.
Where a compromise is suspected, CISA recommends isolating the appliance, rebuilding it from a known-good state and applying the patch, then rotating every credential the appliance stored or injected and revoking all active support sessions. The alert also points to BeyondTrust's published guidance on securing on-premises appliances.
