[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foB9PfHX_HSaidY42B2xWY0clU1NCLphDE3m7Z_1zqE0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":50},"bb09e27f-be4f-4735-b7b9-7a73b6000d39","critical-beyondtrust-auth-bypass-actively-exploited-patch-immediately","b352a90d-ba63-40a4-98f4-432316ecda9e","Critical BeyondTrust Auth Bypass Actively Exploited — Patch Immediately","A critical authentication bypass vulnerability (CVE-2026-102764) in BeyondTrust Remote Support is being actively exploited, allowing threat actors to gain initial access, escalate privileges, and move laterally across networks. Remote support tools are high-value targets because they operate with elevated permissions and broad network access by design, making a successful exploit especially damaging. CISA's addition to the Known Exploited Vulnerabilities (KEV) catalog signals confirmed, real-world exploitation — not just theoretical risk. Organizations running self-hosted appliances that delay patching are directly exposed to full network compromise. This incident underscores that privileged remote access tools demand the highest priority in patch cycles.","**Immediate Actions:**\n- Apply the BT26-05-RS patch or upgrade BeyondTrust Remote Support to version 26.2.3 or later without delay.\n- Audit all internet-facing remote support appliances and verify which versions are currently deployed across your environment.\n- Temporarily restrict or isolate BeyondTrust appliances from sensitive network segments until patching is confirmed complete.\n\n**Long-Term Improvements:**\n- Establish an emergency patching SLA (e.g., 24–72 hours) for CISA KEV-listed vulnerabilities affecting critical infrastructure tools.\n- Maintain a continuously updated inventory of all privileged access and remote support tools, including version and patch status.\n- Implement network segmentation to limit the blast radius of any compromise originating from remote support infrastructure.\n\n**Detection Measures:**\n- Subscribe to CISA KEV catalog alerts and vendor security advisories to ensure timely awareness of newly disclosed exploits.\n- Deploy behavioral monitoring and alerting on BeyondTrust appliances to detect anomalous authentication attempts or lateral movement indicators.\n- Review logs for signs of exploitation activity (unexpected privilege escalation, unusual session initiations) dating back to before the patch was applied.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF RS.MI-3: Newly Identified Vulnerabilities Mitigated","ITIL: Change and Release Management (emergency change process)","CISA Known Exploited Vulnerabilities (KEV) Catalog — CVE-2026-102764",{},"published","2026-10-16T22:21:05.29876+00:00","2026-10-16T22:21:05.267+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F10\u002F16\u002Fcisa-urges-patching-critical-vulnerability-beyondtrust-remote-support","cisa-urges-patching-critical-vulnerability-in-beyondtrust-remote-support-90ef0f","CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[44],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"5bfd8efd-bbf0-427e-a12e-8abbb056097d","2026-10-17","afternoon","ThreatNoir Weekend Brief — October 17","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-17\u002Fthreatnoir-afternoon-brief-2026-10-17.mp3",[51,54,57],{"slug":34,"name":52,"problem":53},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":40,"name":55,"problem":56},"Automated patch management","Known holes get closed in days, not months.",{"slug":58,"name":59,"problem":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]