CISA urges immediate patching of exploited BeyondTrust Remote Support authentication bypass
Remote support platforms hold standing privileged access to large numbers of endpoints, so a compromised instance gives an attacker the reach of an IT administrator. Organisations running self-hosted versions should patch and also treat the window before patching as a possible intrusion: review session logs, newly created accounts and outbound connections from the support server. Older deployments that need a two-step upgrade are the most likely to stay exposed, and they should be prioritised.
What Happened
CISA warned of a critical authentication bypass, CVE-2026-102764, in BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier, and added it to the Known Exploited Vulnerabilities catalog on 16 October 2026. Attackers are using it for initial access, then establishing persistence, escalating privileges and moving laterally. Self-hosted customers must apply patch BT26-05-RS, and those on versions older than 24.3.1 must upgrade first; BeyondTrust-hosted SaaS deployments have already been patched.
Why It Matters
Remote support platforms hold standing privileged access to large numbers of endpoints, so a compromised instance gives an attacker the reach of an IT administrator. Organisations running self-hosted versions should patch and also treat the window before patching as a possible intrusion: review session logs, newly created accounts and outbound connections from the support server. Older deployments that need a two-step upgrade are the most likely to stay exposed, and they should be prioritised.
Sources
- Cybersecurity and Infrastructure Security Agency (opens in a new tab): CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support (2026-10-16)
More From This Briefing
- Anthropic signs first Canadian data centre lease with EverWind in Nova Scotia
- CISA adds exploited Palo Alto PAN-OS, Cisco Secure Email Gateway and Ahsay flaws to KEV catalog
- EU AI Office opens first AI Act enforcement steps against frontier model providers
- ILS Bermuda Convergence warned of investor overexposure to AI and data centre risk
This story is part of the Laurenceo Intelligence briefing for 18 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.