CISA has warned that CVE-2026-102764, a critical authentication bypass flaw in BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier, is being actively exploited in the wild. The vulnerability allows attackers to bypass authentication to gain initial access, after which observed activity includes establishing persistence, escalating privileges, and moving laterally across networks. CISA added it to the Known Exploited Vulnerabilities catalog on Oct. 16, 2026.
Because remote support appliances often operate with privileged access to endpoints and infrastructure, an auth bypass here is especially dangerous for identity and AD security—it hands adversaries a trusted foothold from which to pivot and compromise domain assets. BeyondTrust-hosted (SaaS) deployments are already patched, but self-hosted customers must act, applying the BT26-05-RS patch and upgrading to 24.3.1 or later if on older versions.
What to take away: Patch affected self-hosted Remote Support appliances immediately, restrict external access, and hunt for signs of persistence, privilege escalation, and lateral movement, since exploitation is ongoing.