Critical BeyondTrust Auth Bypass Actively Exploited — Patch Immediately
A critical authentication bypass vulnerability (CVE-2026-102764) in BeyondTrust Remote Support is being actively exploited, allowing threat actors to gain initial access, escalate privileges, and move laterally across networks. Remote support tools are high-value targets because they operate with elevated permissions and broad network access by design, making a successful exploit especially damaging. CISA's addition to the Known Exploited Vulnerabilities (KEV) catalog signals confirmed, real-world exploitation — not just theoretical risk. Organizations running self-hosted appliances that delay patching are directly exposed to full network compromise. This incident underscores that privileged remote access tools demand the highest priority in patch cycles.
Tactical Insight
Immediate Actions
- Apply the BT26-05-RS patch or upgrade BeyondTrust Remote Support to version 26.2.3 or later without delay.
- Audit all internet-facing remote support appliances and verify which versions are currently deployed across your environment.
- Temporarily restrict or isolate BeyondTrust appliances from sensitive network segments until patching is confirmed complete.
Long-Term Improvements
- Establish an emergency patching SLA (e.g., 24–72 hours) for CISA KEV-listed vulnerabilities affecting critical infrastructure tools.
- Maintain a continuously updated inventory of all privileged access and remote support tools, including version and patch status.
- Implement network segmentation to limit the blast radius of any compromise originating from remote support infrastructure.
Detection Measures
- Subscribe to CISA KEV catalog alerts and vendor security advisories to ensure timely awareness of newly disclosed exploits.
- Deploy behavioral monitoring and alerting on BeyondTrust appliances to detect anomalous authentication attempts or lateral movement indicators.
- Review logs for signs of exploitation activity (unexpected privilege escalation, unusual session initiations) dating back to before the patch was applied.