CISA says attackers are exploiting a BeyondTrust Remote Support flaw

CISA says cyber threat actors are actively exploiting CVE-2026-102764, a critical authentication-bypass flaw in BeyondTrust Remote Support. The agency added it to the Known Exploited Vulnerabilities catalog on October 16, 2026. The affected range is version 26.2.3 and earlier.

An authentication bypass lets an attacker get around the normal sign-in control. CISA says attackers are using this flaw to gain initial access, then maintain a foothold, escalate privileges and move laterally to other parts of a network. The alert confirms exploitation, but it does not identify a victim count.

Patch status depends on how Remote Support is hosted

CISA urges operators of affected self-hosted appliances to apply the BT26-05-RS patch immediately. Supported versions start at 24.3.1; organizations running an older self-hosted version will need to upgrade before they can apply the patch. BeyondTrust-hosted SaaS deployments have already been patched.

Patching is only one part of the response. CISA advises limiting outside access to necessary services, restricting administrative interfaces to trusted networks, and using network and memory forensics to look for compromise. Warning signs include unknown privileged sessions, unfamiliar scripts, gaps in logging, and unauthorized changes to accounts, permissions or session policies.

Where compromise is suspected, CISA recommends rebuilding from a known-good state, applying the patch, rotating every credential stored or injected by the appliance, revoking active support sessions, and reviewing new multifactor-authentication registrations on privileged accounts. Those recovery steps address persistence that a patch alone may leave behind.