CISA says attackers are exploiting a critical flaw in BeyondTrust Remote Support, and it added the bug to its Known Exploited Vulnerabilities list on 16 October 2026. Self-hosted appliances on version 26.2.3 or earlier should be patched now. The KEV due date for US federal agencies is 19 October 2026.
What the flaw is
The bug is tracked as CVE-2026-102764. CISA calls it a critical authentication bypass. The National Vulnerability Database describes internal components of Remote Support that did not adequately validate the origin of the messages they received, which under the right conditions lets an attacker perform file operations on the appliance. It is filed as CWE-290, authentication bypass by spoofing.
The Canadian Cyber Centre adds that the flaw needs no credentials and no user action, and that it can enable arbitrary file uploads and potentially full compromise of the appliance. NVD lists a CVSS v3.1 score of 9.8, and a CVSS v4.0 score of 9.3 in the record supplied by the CVE numbering authority.
Who is affected and what to install
Remote Support 26.2.3 and earlier are affected. The fix for self-hosted appliances running 24.3.1 up to 26.2.3 is the BT26-05-RS patch from BeyondTrust Security Advisory BT26-05. Appliances older than 24.3.1 must be upgraded first and then patched.
BeyondTrust-hosted SaaS deployments are already patched, per CISA. The Cyber Centre says the SaaS patch was applied as of 9 October 2026, six days before the advisory and the CVE record appeared. If your support team uses the hosted service, there is nothing to install, but it is worth confirming how each deployment is run.
What CISA says attackers do with it
According to CISA, actors use the flaw for initial access and then move on to persistence, privilege escalation and lateral movement. A remote support appliance is a sensitive target because it is built to reach many internal machines. Anyone who gets control of it may inherit that reach, along with any credentials the appliance stores.
CISA does not attribute the activity to a named actor, so we do not attribute it either.
What to do if you run it yourself
- List every Remote Support deployment and note whether it is SaaS or self-hosted, and which version it runs.
- Apply the BT26-05-RS patch, or upgrade first if you are below 24.3.1. Confirm automatic updates are on.
- Allow outside access only to the services users need, and keep administrative interfaces on trusted networks.
- Check for signs of compromise: unrecognized privileged or administrative sessions, unrecognized script files, gaps in logs or log forwarding, and unauthorized changes to accounts, permissions or session policies.
If you suspect a compromise, CISA advises isolating the appliance and keeping a snapshot or forensic image, then rebuilding from a known-good state and applying the patch. After that, rotate every credential the appliance stored or injected, revoke all active support sessions and review new MFA registrations on privileged accounts. Forward appliance syslog and session events to your SIEM, and collect web application firewall, reverse proxy and perimeter firewall logs for the exposure window.
Why it matters beyond one product
Remote support tools have been a repeated target. We covered an earlier BeyondTrust command injection flaw and the ScreenConnect authentication bypass, and we looked at remote support flaws in ransomware attacks. The pattern is the same each time: an internet-facing tool with deep access to many internal machines. Teams that keep an inventory of these tools, with their versions and how they are exposed, can answer a new alert much faster.
A listing in the Known Exploited Vulnerabilities catalog is a strong signal to patch first. For help ranking such alerts against others, see our note on CVSS, EPSS and CISA KEV signals.