Organizations running self-hosted BeyondTrust Remote Support (formerly Bomgar) should patch now, because CISA says attackers are already exploiting CVE-2026-102764.
The flaw is a critical authentication bypass affecting versions 26.2.3 and earlier. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on October 16, 2026. According to CISA, the attackers use it to gain initial access, then establish persistence, escalate privileges and move laterally. The fix is the BT26-05-RS patch, described in BeyondTrust's Security Advisory BT26-05. Patches cover supported versions (24.3.1 and later), so anyone on an older self-hosted release has to upgrade before they can apply it. BeyondTrust-hosted (SaaS) deployments are already patched.
The guidance goes well past "install the update." CISA also tells self-hosted customers to limit external access to the appliance, keep administrative interfaces on trusted networks, and run network and memory forensics to look for signs of compromise. For suspected breaches, it calls for isolating the appliance, preserving a snapshot or forensic image, forwarding syslog and session events to the SIEM (the system that collects security logs), and then rebuilding from a known-good state. Mandiant's write-up, titled ARMORY CASTLE Exploits BeyondTrust, and BeyondTrust's own blog on ARMORY CASTLE and BT26-05 supply additional hunt and detection guidance.
The cleanup list shows why this one is serious. A remote support appliance is built to reach into other machines, so CISA's instructions to rotate every credential the appliance stored or injected, revoke all active support sessions and review new multifactor registrations on privileged accounts treat it as a doorway into everything it touches. A patch closes the door but does not remove someone already inside.
No exploitation or exposure counts have been published. CISA also points readers to its Binding Operational Directive 26-04 for ranking fixes by risk, and a KEV listing is the clearest signal it gives that a bug belongs at the top of that ranking.