CISA is urging organizations to patch a critical authentication-bypass vulnerability in BeyondTrust Remote Support after confirming that attackers are exploiting it. The flaw, CVE-2026-102764, affects Remote Support versions 26.2.3 and earlier and can let a remote attacker perform file operations on an appliance. [1] [2]
BeyondTrust’s Oct. 15 advisory describes the issue as improper origin validation in an internal messaging component. The CVE record assigns it a critical CVSS 4.0 score of 9.3. BeyondTrust says the flaw is fixed by its BT26-05-RS patch for Remote Support versions 24.3.1 through 26.2.3; deployments older than 24.3.1 must first upgrade. The vendor says it applied the patch to its Remote Support SaaS customers on Oct. 9. [2] [3]
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on Oct. 16 and lists an Oct. 19 due date under its federal vulnerability-management requirements. That deadline applies to the federal agencies covered by the directive; CISA separately urges all organizations with affected self-hosted appliances to act immediately. [1] [4]
Patching is not the only step
CISA says attackers have used the flaw to gain initial access and then establish persistence, escalate privileges and move laterally. It recommends that operators of affected self-hosted systems apply the patch and restrict external access to services needed for support. Organizations that may have been compromised should preserve appliance and network evidence, investigate for unauthorized privileged sessions or changes, and follow CISA’s isolation and recovery guidance. [1]
Google Threat Intelligence Group and Mandiant say they found evidence of exploitation in late August during an incident-response investigation. They attribute that activity to the suspected China-nexus group ARMORY CASTLE, while warning that other attackers could exploit the issue after disclosure. This is a threat-intelligence assessment from the investigated incidents, not a public attribution for every exploitation attempt. [5]
Because the appliance may store or broker credentials, CISA says a suspected compromise calls for more than a routine update: investigate, rebuild from a known-good state when warranted, rotate credentials the device stored or injected, and revoke active support sessions. [1]