Critical Authentication Bypass in BeyondTrust Remote Support (CVE‑2026‑102764) Threatens Remote Access Appliances
What It Is — A critical authentication‑bypass flaw (CVE‑2026‑102764) exists in self‑hosted BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. The vulnerability allows an unauthenticated attacker to obtain administrative access to the appliance.
Exploitability — Actively exploited in the wild; CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 16 Oct 2026.
Affected Products — BeyondTrust Remote Support self‑hosted appliances ≤ 26.2.3 (SaaS deployments have already been patched). Patches are available for supported versions ≥ 24.3.1.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that authentication controls remain intact after any software change.
- Highlights the importance of maintaining auditable evidence of patch‑management and privileged‑session logging to satisfy downstream audit requirements.
- Forces organizations to prove that remote‑access pathways are limited to trusted networks, a key control that many frameworks map to a single “access‑control” objective.
Recommended Actions
- Upgrade all self‑hosted Remote Support appliances to version 24.3.1 or later, then apply the BT26‑05‑RS patch.
- Immediately restrict external network access to the appliance and limit administrative interfaces to trusted subnets.
- Forward appliance syslog and session events to your SIEM; retain logs for the full exposure window.
- Conduct forensic imaging of any appliance that may have been compromised and hunt for anomalous privileged sessions.
- Rotate all stored credentials and session‑policy secrets after remediation.
Source: CISA Advisory – 16 Oct 2026