BeyondTrust flaw exploited since August now has a patch
CVE-2026-102764 hits Remote Support 26.2.3 and earlier; Google ties it to a China-linked group and CISA urges patching.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-102764 to its catalog of exploited vulnerabilities on Oct. 16. It is a flaw that lets an attacker bypass authentication in BeyondTrust Remote Support, according to CISA. The program, formerly called Bomgar, is used by companies to give remote support to their users' computers. CISA says attackers are already using it.
For anyone running their own server, the first question is the version. The flaw affects 26.2.3 and earlier, and a patch exists. Installations hosted by BeyondTrust itself have already been fixed, according to CISA.
| Item | Detail |
|---|---|
| CVE | CVE-2026-102764, authentication bypass |
| Product | BeyondTrust Remote Support |
| Affected versions | 26.2.3 and earlier |
| Patch | BT26-05-RS (advisory BT26-05), for 24.3.1 and later |
Anyone on a version earlier than 24.3.1 must update first, CISA says. For self-hosted appliances, the agency asks for:
- Patch: apply BT26-05-RS immediately.
- Access: limit external exposure to what is necessary and keep administrative interfaces on trusted networks.
- If compromise is suspected: isolate the appliance, rebuild it from a known good state, rotate every credential it stored and revoke active sessions.
There is a reason for the emphasis on rebuilding rather than just patching. Google Threat Intelligence and Mandiant published on Oct. 15 that a group they call ARMORY CASTLE, previously tracked as UNC5221 and suspected of spying for Chinese interests, used the flaw as a zero-day (a flaw exploited before a patch exists) from late August 2026. According to Mandiant, once inside, the group escalated to administrator, took stored credentials, deleted logs and changed permissions to keep its access. That attribution is Google's and Mandiant's, because CISA's alert does not make it. CrowdStrike calls the group WARP PANDA, according to BleepingComputer.
That outlet also reports that the company patched its hosted installations first. The date differs between sources: Oct. 9 for Google, Oct. 8 for BleepingComputer. Its privileged-access product, Privileged Remote Access, shares the affected code; BeyondTrust said its tests found no way to exploit it there, and it also released a patch. Shadowserver tracks more than 1 400 Remote Support instances visible on the internet, without saying how many remain unpatched.
It is still unknown how many organizations were compromised and whether any victims are in Mexico: no source says. BeyondTrust's advisory BT26-05 returned a 403 error to this newsroom's automated request and could not be read.
