CISA Urges Patching Critical BeyondTrust Remote Support Vulnerability

On October 16, 2026, CISA issued an alert regarding the active exploitation of CVE-2026-102764, a critical authentication bypass vulnerability affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Threat actors, including activity tracked as ARMORY CASTLE, are utilizing this flaw to bypass authentication mechanisms, establish persistence, and escalate privileges within targeted environments. Due to its active exploitation, CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog.

The attack chain typically begins with unauthorized initial access via the vulnerable appliance, followed by lateral movement and privilege escalation. While SaaS deployments have been patched by the vendor, self-hosted appliances require immediate manual patching or upgrades if running versions older than 24.3.1.

Failure to remediate this vulnerability poses a significant risk to organizational integrity, as these appliances often hold privileged access to internal infrastructure. Affected organizations should prioritize patching, restrict network access to administrative interfaces, and conduct thorough forensic investigations for signs of compromise.