Critical flaw in BeyondTrust Remote Support: what to review in your remote access tools

On October 16, 2026, CISA, the US cybersecurity agency, published an alert urging organizations to patch BeyondTrust Remote Support (formerly Bomgar) immediately. The flaw, tracked as CVE-2026-102764, is already being exploited and was added that same day to the agency’s Known Exploited Vulnerabilities (KEV) catalog.

Remote support tools exist to open the door to computers and servers for authorized technicians. When one of them has a flaw, that door can open for the wrong people. That is why this case matters even to companies that don’t use this product.

What happened

According to BeyondTrust security advisory BT26-05, issued on Oct 15, 2026, internal messaging components in Remote Support did not properly validate the origin of the messages they received. Under the right conditions, a remote attacker could use this to perform file operations on the appliance. The vendor rates it critical, with a CVSS v4 score of 9.3.

The Canadian Centre for Cyber Security adds that exploitation requires no credentials or user interaction and can lead to full compromise of the appliance.

CISA says attackers are using the flaw for initial access, then establishing persistence, escalating privileges and moving laterally through the network.

Who needs to act

• Affected versions: all Remote Support versions up to and including 26.2.3.
• Remote Support SaaS (hosted by BeyondTrust): the vendor says the fix was applied to all customers as of Oct 9, 2026.
• Self-hosted Remote Support: apply the BT26-05-RS patch, available for versions 24.3.1 through 26.2.3. Anyone on a version older than 24.3.1 must upgrade first.
• Self-hosted Privileged Remote Access (PRA): in its BT26-05 blog post, BeyondTrust says it found no way to exploit the flaw in PRA, but because the code is shared it released the patch for PRA too and recommends applying it.

What to do now if you use the product

For self-hosted appliances, CISA recommends:

1. Apply the BT26-05-RS patch (upgrading first if needed).
2. Limit external access to the appliance to the services you need, and restrict administrative interfaces to trusted networks.
3. Run network and memory forensics for signs of compromise, such as unrecognized privileged sessions, unknown scripts, unexpected gaps in logs, and unauthorized changes to accounts, permissions or session policies.

If you suspect a compromise, the guidance is to isolate the appliance, preserve an image for forensics, forward logs to your SIEM, rebuild from a known-good state with the patch applied, then rotate every credential the appliance stored or injected, revoke active support sessions, and review new MFA registrations on privileged accounts.

What any company can review, even without BeyondTrust

This case is a good reminder that remote access tools deserve the same care as your firewall or email. A simple review:

• Inventory: which remote access tools are in use today, including those used by vendors and outside support providers?
• Hosting model: is each one SaaS or self-hosted? For self-hosted tools, patching is on your team or your provider.
• Updates: are automatic updates turned on? Who follows the vendor’s security advisories?
• Exposure: is the admin console reachable from the internet? If so, does it need to be?
• Access: do all technicians and admin accounts use MFA? Have accounts for people who left been removed?
• Logging: are session logs kept outside the tool itself, so you can review them after an incident?
• Providers: can your IT provider tell you within a few hours whether an alert like this one affects you?

Not every item applies to every environment. The point is to be able to answer these questions before the next alert arrives.

How CGT can help

CGT supports small and mid-sized companies with IT management, security and Microsoft 365, within the scope agreed with each client: tool inventory, access reviews, and tracking of updates and security alerts.

Want to review how remote access works at your company? Meet CGT and get in touch.

Sources: CISA alert, Oct 16, 2026, BeyondTrust advisory BT26-05 and Canadian Centre for Cyber Security alert AL26-025.