CISA reports active exploitation of CVE-2026-102764, a critical authentication-bypass flaw affecting BeyondTrust Remote Support 26.2.3 and earlier. Organizations using self-hosted appliances should patch while assessing whether the appliance has been compromised.
1. Confirm version and deployment
Identify whether Remote Support is self-hosted or BeyondTrust-hosted. CISA states that SaaS deployments have already been patched. For self-hosted appliances, BT26-05-RS is available for supported versions 24.3.1 and later; older versions must be upgraded before the patch can be applied.
2. Patch and reduce exposure
Apply the patch according to BeyondTrust advisory BT26-05. Limit external access to only the services required for support, and restrict administrative interfaces to trusted networks. Review network-connectivity controls for the appliance.
3. Investigate possible compromise
If compromise is suspected, isolate the appliance. Capture a virtual-appliance snapshot or a forensic image of a physical appliance, then preserve the evidence. Forward appliance syslog and session events to the SIEM, and retain relevant WAF, reverse-proxy, and perimeter-firewall logs for the exposure period.
Hunt for unrecognized privileged sessions, unexpected script files, gaps in logging or log forwarding, and unauthorized changes to accounts, permissions, or session policies.
Why it matters
Successful exploitation can provide initial access and enable persistence, privilege escalation, and lateral movement.
Practical takeaway
After investigation, rebuild the appliance from a known-good state, apply the patch, rotate every credential it stored or injected, revoke active support sessions, and review new MFA registrations on privileged accounts.