Source: cisa.gov
CISA has issued an alert regarding CVE-2026-102764, a critical authentication bypass vulnerability in BeyondTrust Remote Support (formerly Bomgar) affecting versions 26.2.3 and earlier. The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog as threat actors are actively exploiting it to gain initial access, establish persistence, escalate privileges, and move laterally. Organizations using self-hosted appliances must apply the BT26-05-RS patch; those on versions older than 24.3.1 must upgrade first. BeyondTrust-hosted SaaS deployments have already been patched. CISA recommends isolating potentially compromised appliances, conducting forensic investigations, hunting for indicators of compromise such as unrecognized privileged sessions or unauthorized account changes, and rebuilding from a known-good state. After remediation, organizations should rotate all credentials stored or injected by the appliance and revoke active support sessions. Mandiant has published additional guidance under the campaign name ARMORY CASTLE.
