HomeOctober 2026 patch cycleBeyondTrust Remote Support: the remote-access tool attackers are using for remote access
Call: Patch nowCategory: Enterprisefrom 2026-10
BeyondTrust Remote Support: the remote-access tool attackers are using for remote access
Part of October 2026 patch cycle
- Vendor
- BeyondTrust
- Products
- Remote Support
- Published
- Status
- Open
Call: Patch now. CVE-2026-102764 (CVSSv4 9.3) is an origin-validation flaw in BeyondTrust Remote Support that lets a remote attacker perform file operations on the appliance. CISA says it’s being actively exploited for initial access, followed by persistence, privilege escalation and lateral movement. It’s in KEV, and the federal due date was Oct 19.
What breaks: Nothing breaks. The trouble is the extra visitor on your support appliance.
Who’s hit:
- Self-hosted Remote Support (formerly Bomgar) 26.2.3 and earlier that isn’t on automatic updates.
- BeyondTrust patched SaaS customers by Oct 9.
Workaround:
- Apply the BT26-05-RS patch. It covers 24.3.1 through 26.2.3.
- Anything older than 24.3.1 has to be upgraded before the patch will install.
- If you were exposed, treat the appliance as suspect: investigate it and rotate the credentials it stores.
Sources: BeyondTrust BT26-05 (opens in a new tab), CISA (opens in a new tab), Security Affairs (opens in a new tab).
Sources
- https://www.beyondtrust.com/trust-center/security-advisories/bt26-05 (opens in a new tab)
- https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support (opens in a new tab)
- https://securityaffairs.com/201178/security/u-s-cisa-adds-fortinet-multiple-products-and-beyondtrust-remote-support-flaws-to-its-known-exploited-vulnerabilities-catalog.html (opens in a new tab)