(TLP:CLEAR) Vulnerability Notification – BeyondTrust Remote Support Actively Exploited
Created: Thursday, October 22, 2026 - 12:43
Categories: Cybersecurity, Federal & State Resources, Security Preparedness
ACTION MAY BE REQUIRED for utilities using self-hosted BeyondTrust Remote Support (formerly Bomgar) appliances running version 26.2.3 or earlier, as well as self-hosted BeyondTrust Privileged Remote Access appliances. Utilities that outsource technology support may need to consult their service providers for assistance with remediation actions.
Summary: A critical authentication bypass vulnerability affecting BeyondTrust Remote Support is being actively exploited in the wild. Tracked as CVE-2026-102764 (CVSSv4 9.3), the vulnerability allows an unauthenticated remote attacker to perform file operations on an affected appliance. This can lead to host-level control and access to every credential the appliance stores or brokers.
On October 16, CISA released an alert, “CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support.“ The same day, it added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog. CISA reports that threat actors are using the vulnerability to gain initial access. They then establish persistence, escalate privileges, and move laterally.
Mandiant attributes zero-day exploitation of the vulnerability, beginning in late August 2026, to ARMORY CASTLE (formerly UNC5221). ARMORY CASTLE is a suspected PRC-nexus espionage actor. It has historically shifted to broad, opportunistic exploitation once a vulnerability becomes public.
This vulnerability is a serious concern for utilities because remote support tools often broker privileged access to downstream systems. In observed attacks, threat actors were able to harvest passwords, obtain admin access, connect to adjacent systems, and delete logs.
Recommended Actions
WaterISAC strongly encourages members to review and follow the guidance in CISA’s alert and BeyondTrust’s Security Advisory BT26-05. CISA’s key recommendations include applying the BT26-05-RS patch immediately (or upgrading first if running a version older than 24.3.1), limiting external access to the appliance and restricting interfaces to trusted networks.
Additional Reading