The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-102764, a critical authentication bypass vulnerability affecting BeyondTrust Remote Support, to its Known Exploited Vulnerabilities catalog.
The vulnerability affects versions 26.2.3 and earlier of BeyondTrust Remote Support (formerly Bomgar). It carries a CVSSv4 score of 9.3 and is classified under CWE-290 as improper origin validation in an internal messaging component.
BeyondTrust states that on August 29, 2026, an actor exploited a zero-day vulnerability against one BeyondTrust-hosted instance and one self-hosted appliance. The company assesses with moderate to high confidence that the activity belongs to a China-nexus actor tracked as ARMORY CASTLE by Mandiant and WARP PANDA by CrowdStrike. BeyondTrust reports that its Cyber Defense team contained the affected instance within 27 minutes of detection and has not seen evidence of adversary activity since August, noting they are only aware of two impacted customers.
CISA reports that cyber threat actors are actively exploiting the vulnerability to gain initial access, establish persistence, escalate privileges, and move laterally. BeyondTrust states it is withholding technical details of the vulnerability to avoid increasing risk to unpatched customers.
The BT26-05-RS patch is available for Remote Support versions 24.3.1 through 26.2.3; versions older than 24.3.1 must be upgraded first. As of October 9, 2026, the patch had been applied to all Remote Support SaaS customers.
- August 29, 2026: An actor exploited a zero-day vulnerability against one BeyondTrust-hosted instance and one self-hosted appliance.
- October 16, 2026: CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog.
References