BeyondTrust Remote Support auth bypass is exploited in the wild, CISA adds it to KEV

On October 16 CISA published an unusually blunt alert: BeyondTrust Remote Support (formerly Bomgar) has an authentication bypass, CVE-2026-102764, affecting 26.2.3 and earlier, already exploited in the wild, and added to the KEV catalog the same day.

Why this is more urgent than the average CVE

Remote Support is the appliance that lets support staff reach into machines. It sits on the trust boundary by design: the outside must be able to connect in, and the inside must be able to launch privileged sessions. An unauthenticated bypass means the door is simply gone — an attacker needs no account to obtain what looks like a legitimate remote support session, then uses it for persistence, privilege escalation and lateral movement.

CISA describes a full chain: use the flaw for initial access, then establish persistence, escalate privileges, move laterally. This is not “theoretically exploitable”; it is a breach that has happened.

Patch and version path

• The fix is BT26-05-RS, documented in BeyondTrust security advisory BT26-05
• Supported versions from 24.3.1 onward can patch directly; anything older than 24.3.1 must upgrade first
• BeyondTrust-hosted (SaaS) deployments are already patched — nothing to do there

The trap here is “we’re on an old version, we’ll deal with it later”. Old versions are exactly the ones that cannot take the patch.

Beyond patching

CISA’s guidance splits into shrinking exposure and doing forensics.

Shrink exposure: limit external reachability to only the services users and customers need, and restrict administrative interfaces to trusted networks. The classic failure mode for appliances like this is “the admin port is open to the world because it makes operations easier”.

Forensics (for appliances that were exposed): isolate suspected hosts; snapshot virtual appliances or image physical ones; forward appliance syslog and session events to the SIEM immediately; and backfill WAF, reverse-proxy and perimeter firewall logs for the exposure window.

What to hunt for

CISA lists concrete hunting leads worth copying into a checklist:

• Unrecognised privileged or administrative sessions
• Unrecognised script files
• Unexpected gaps in logs or log forwarding (the easiest to miss — attackers often turn logging off first)
• Unauthorized account, permission or session-policy changes

The judgement

Unauthenticated bypasses on edge appliances have been the most reliable intrusion path of the last two years: no phishing, no credentials, just an appliance reachable from the internet. The response cadence should be hours, not days — patch, shrink the exposed surface, then assume you were probed and go collect evidence.

Source: CISA alert “CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support” (2026-10-16) and BeyondTrust advisory BT26-05.