[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-cisa-flags-actively-exploited-beyondtrust-remote-support-flaw":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},11745,"cisa-flags-actively-exploited-beyondtrust-remote-support-flaw","CISA Flags Actively Exploited BeyondTrust Remote Support Flaw","Attackers are exploiting an authentication bypass in self-hosted BeyondTrust appliances, and a suspected breach means a rebuild, not just a patch.","Organizations running self-hosted BeyondTrust Remote Support (formerly Bomgar) should patch now, because CISA says attackers are already exploiting CVE-2026-102764.\n\nThe flaw is a critical authentication bypass affecting versions 26.2.3 and earlier. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on October 16, 2026. According to CISA, the attackers use it to gain initial access, then establish persistence, escalate privileges and move laterally. The fix is the BT26-05-RS patch, described in BeyondTrust's Security Advisory BT26-05. Patches cover supported versions (24.3.1 and later), so anyone on an older self-hosted release has to upgrade before they can apply it. BeyondTrust-hosted (SaaS) deployments are already patched.\n\nThe guidance goes well past \"install the update.\" CISA also tells self-hosted customers to limit external access to the appliance, keep administrative interfaces on trusted networks, and run network and memory forensics to look for signs of compromise. For suspected breaches, it calls for isolating the appliance, preserving a snapshot or forensic image, forwarding syslog and session events to the SIEM (the system that collects security logs), and then rebuilding from a known-good state. Mandiant's write-up, titled ARMORY CASTLE Exploits BeyondTrust, and BeyondTrust's own blog on ARMORY CASTLE and BT26-05 supply additional hunt and detection guidance.\n\nThe cleanup list shows why this one is serious. A remote support appliance is built to reach into other machines, so CISA's instructions to rotate every credential the appliance stored or injected, revoke all active support sessions and review new multifactor registrations on privileged accounts treat it as a doorway into everything it touches. A patch closes the door but does not remove someone already inside.\n\nNo exploitation or exposure counts have been published. CISA also points readers to its Binding Operational Directive 26-04 for ranking fixes by risk, and a KEV listing is the clearest signal it gives that a bug belongs at the top of that ranking.","[\"beyondtrust\",\"cisa\",\"vulnerability\",\"remote-support\"]","2026-10-16T12:00:00.000Z","2026-10-18T09:25:18.856Z","2026-10-18T09:25:20.993Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Name CISA explicitly instead of 'the US cybersecurity agency' or 'the agency', and give the year for the October 16 KEV date. Remove the 'The source does not say...' line, which is a sourcing note, and recast it as a plain statement that no exploitation or exposure counts have been published. Add the Mandiant ARMORY CASTLE attribution and BeyondTrust's advisory BT26-05 as named sources. Cut or soften the speculation that those unknown counts 'will decide how long the cleanup takes'.","resolved","security",[32,33,34,35],"beyondtrust","cisa","vulnerability","remote-support",[37],{"name":38,"url":39},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F10\u002F16\u002Fcisa-urges-patching-critical-vulnerability-beyondtrust-remote-support",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7040,"2026-10-18T11:00:00.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1004,"2026-10-18T12:05:00.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",539,"2026-10-17T19:38:12.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",524,"2026-10-17T07:00:00.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",265,"2026-10-18T13:24:23.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",236,"2026-10-16T23:36:26.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",203,"2026-10-17T12:40:00.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Startups","startups",134,"2026-10-18T12:02:57.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Software","software",129,"2026-10-15T22:21:06.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",118,"2026-10-16T15:52:39.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",82,"2026-10-16T16:06:38.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",77,"2026-10-17T16:59:39.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",37,"2026-10-14T10:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]