BeyondTrust Remote Support Has a Critical Bug and Attackers Are Already Inside. Federal Agencies Have Three Days.

Key points

• CISA added CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support, to its must-patch list on October 16, 2026, giving federal agencies three days to fix it.
• The bug lets attackers skip the login check entirely and carry out file operations on the appliance.
• Attackers are already using the hole to break in, set up long-term access, and move across victim networks.
• Self-hosted versions 26.2.3 and earlier are vulnerable; cloud-hosted customers were patched automatically.
• Mandiant has published hunt guidance covering the exploitation campaign under the name ARMORY CASTLE.

The US Cybersecurity and Infrastructure Security Agency has told federal civilian agencies to patch a critical bug in BeyondTrust Remote Support by October 19, 2026, three days after the flaw landed on its Known Exploited Vulnerabilities catalogue. This is the fifth time we've covered a BeyondTrust security event since July, and the pattern is getting harder to ignore; our 3 October story found attackers knocking on a BeyondTrust flaw within four days of it going public.

BeyondTrust Remote Support, formerly sold under the Bomgar name, is the software IT help desks use to take control of a staff member's computer from a distance to fix problems. If an attacker owns that software, they own a channel straight into every machine the help desk touches.

That's what's happening now.

What is the bug and how bad is it?

CVE-2026-102764 is an authentication bypass, meaning it lets an attacker on the internet skip the login check on a Remote Support appliance and carry out file operations on it.

Parts of the product didn't properly check where incoming messages were coming from. A remote attacker who sent the right traffic could impersonate a trusted component, then read or manipulate files on the box.

From there, CISA says the attackers are establishing persistence (planting something that keeps their access alive after a reboot), escalating their privileges, and moving sideways into other systems on the same network.

Who needs to act?

Any organisation running a self-hosted Remote Support appliance on version 26.2.3 or earlier. BeyondTrust's cloud-hosted customers have already been patched and don't need to do anything.

The fix is a patch BeyondTrust calls BT26-05-RS. Customers still running a version older than 24.3.1 have to upgrade first before the patch will apply, which means the oldest deployments, often the least watched, need the most work.

Should ordinary people worry?

Not directly, but indirectly yes. Remote Support appliances sit inside banks, hospitals and government offices. A break-in there can turn into the kind of data theft or ransomware incident that shows up as a letter in your mailbox weeks later.

If your employer uses BeyondTrust, expect your IT team to force password resets and revoke active remote support sessions over the coming days. CISA is telling defenders to rotate every credential the appliance stored or injected, check for new multifactor authentication registrations on privileged accounts (a classic sign an intruder is setting up a back door), and review any unexpected gaps in logs.

My read

A three-day federal patch deadline is unusually tight. CISA normally gives three weeks. That timing, combined with Mandiant publishing hunt guidance under the ARMORY CASTLE name, tells you the exploitation isn't theoretical and isn't narrow. Remote support software has become one of the most reliable ways into a corporate network, and we've covered the same playbook twice in two weeks with Ivanti and now BeyondTrust. Self-hosted customers who've let the appliance drift behind on versions are the ones most likely to find out the hard way.