CVE-2026-102764: BeyondTrust Remote Support Auth Bypass — Emergency Patch and Compromise Hunt Guide

CISA is warning that a critical authentication bypass in BeyondTrust Remote Support, formerly Bomgar, is being actively exploited. The issue is tracked as CVE-2026-102764 and affects self-hosted Remote Support appliances running version 26.2.3 and earlier. Patches are available for supported releases 24.3.1 and later; organizations on older unsupported builds must upgrade before they can apply the fixed line. CISA added the CVE to the Known Exploited Vulnerabilities catalog on October 16, 2026, which means this is not a theoretical exposure. Treat Internet-reachable Remote Support appliances as compromised until patched, validated, and hunted.

What is at risk

BeyondTrust Remote Support sits in a high-trust position. It is used by help desks, administrators, vendors, and incident responders to initiate privileged remote sessions into endpoints and servers. An authentication bypass against the appliance is not just a web bug. It can become a direct path into the management plane that already has authority to connect to sensitive systems.

The reported intrusion sequence is the pattern defenders should assume: exploit the exposed appliance for initial access, establish persistence, escalate privileges, then move laterally using the very access pathways Remote Support is designed to provide. In practical terms, a successful exploit can let an actor operate as if they were a legitimate support technician, with all the trust and audit ambiguity that implies.

Technical analysis

Affected product: BeyondTrust Remote Support, self-hosted appliances, formerly Bomgar.

Affected versions: 26.2.3 and earlier according to the CISA alert. Patches are available for supported versions 24.3.1 and later. If you are below 24.3.1, you are not in a patch-and-go posture; you must first upgrade into a supported release train, then apply the fix.

Fix: Apply the BT26-05-RS patch as described in BeyondTrust Security Advisory BT26-05. Use the BeyondTrust Trust Center security advisories hub and the CISA alert as the authoritative sources.

CVE: CVE-2026-102764. CISA describes it as critical. The public alert summary does not provide a CVSS vector, so defenders should not wait for a score to prioritize action. An authentication bypass on a remote access platform, confirmed exploited and KEV-listed, is an emergency-change class event.

Attack chain from a defender perspective:

1. The attacker identifies an exposed self-hosted Remote Support appliance, typically over HTTPS.
2. The authentication bypass is used to obtain access without valid credentials.
3. The actor creates or abuses session capability, deploys persistence, and attempts to blend into normal remote support workflows.
4. Privilege escalation follows through credential capture, token theft, local account creation, service installation, scheduled tasks, or abuse of support tooling.
5. Lateral movement proceeds over protocols the environment already permits for administration, including SMB, WinRM, RDP, SSH, and remote support tunnels.

Exploitation status: confirmed active exploitation and inclusion in CISA KEV on October 16, 2026. That combination requires both remediation and retroactive compromise assessment. Patching alone does not clear an appliance that was reachable before the fix.

Immediate defensive posture

Assume the management interface is high value and potentially exposed. Inventory every self-hosted appliance, including disaster recovery nodes, lab appliances that are accidentally reachable, vendor-managed instances, and forgotten Bomgar-era deployments. Confirm whether the administrative and session interfaces are Internet-facing, behind a VPN, or fronted by a reverse proxy. Do not trust the console hostname alone; validate with external attack-surface data, firewall rules, load balancer listeners, DNS records, and proxy logs.

If the appliance cannot be patched immediately, isolate it. Disable inbound Internet access to the administrative interface, restrict session traffic to known egress paths, and require VPN plus strong authentication for support staff. If you suspect pre-patch exposure, rotate credentials that could have touched the platform: appliance admins, integrated directory accounts, API keys, service accounts, jump host credentials, local endpoint admin passwords, and any secrets stored in session scripts or tooling.

Detection and response

The highest-value hunt is temporal: compare external authentication activity to the appliance against the first observable persistence or privileged action inside the environment. Look for a burst of failed or anomalous appliance authentication followed by a success from an unusual source, then new local admins, services, tasks, remote execution tools, or support sessions outside approved change windows.

Sigma rules

---
title: BeyondTrust or Bomgar Process Spawning Shell or Admin Tools
id: 6d1f2f8a-9f42-4c83-9a58-2f3e7c101a01
status: experimental
description: Detects BeyondTrust Remote Support or Bomgar components spawning shells or administration utilities that may indicate post-exploitation after CVE-2026-102764.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/16
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'BeyondTrust'
      - 'Bomgar'
      - 'Remote Support'
  selection_child:
    Image|contains:
      - 'cmd.exe'
      - 'powershell.exe'
      - 'pwsh.exe'
      - 'wscript.exe'
      - 'cscript.exe'
      - 'rundll32.exe'
      - 'regsvr32.exe'
      - 'net.exe'
      - 'net1.exe'
      - 'nltest.exe'
      - 'sc.exe'
      - 'schtasks.exe'
      - 'wmic.exe'
      - 'psexec.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate technician actions during approved remote support sessions
  - Vendor update or diagnostic tooling
level: high
---
title: Persistence Commands Launched Under Remote Support Context
id: 0b7cc6e1-44db-4f8f-93aa-9a706ed20b22
status: experimental
description: Detects account creation, service creation, scheduled tasks, or run key changes executed in the context of BeyondTrust or Bomgar remote support activity.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support
  - https://attack.mitre.org/techniques/T1136/
  - https://attack.mitre.org/techniques/T1053/
  - https://attack.mitre.org/techniques/T1543/
author: Security Arsenal
date: 2026/10/16
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1136.001
  - attack.t1053.005
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'BeyondTrust'
      - 'Bomgar'
      - 'Remote Support'
  selection_cmd:
    CommandLine|contains:
      - 'net user'
      - 'localgroup administrators'
      - 'schtasks'
      - 'sc create'
      - 'CurrentVersion'
      - 'Run'
      - 'New-Service'
      - 'Set-ItemProperty'
      - 'reg add'
  condition: selection_parent and selection_cmd
falsepositives:
  - Authorized break-glass administration
  - Software deployment through approved support sessions
level: critical

Microsoft Sentinel and Defender KQL

Use this hunt across CEF, syslog, proxy, firewall, and endpoint telemetry. It looks for suspicious appliance authentication pressure and then correlates to privileged host behavior. Tune source allowlists to your normal support operations before production use.

let lookback = 14d;
let appliance_hosts = dynamic(['remote-support.example.com','support.example.com']);
let auth_events =
  union isfuzzy=true CommonSecurityLog, Syslog
  | where TimeGenerated >= ago(lookback)
  | extend msg = coalesce(Message, AdditionalExtensions, '')
  | where DeviceVendor has_any ('BeyondTrust','Bomgar') or DeviceProduct has 'Remote Support' or msg has_any ('BeyondTrust','Bomgar','Remote Support')
  | where msg has_any ('login','authentication','auth','session','admin') or Activity has_any ('login','authentication','session')
  | extend src = tostring(coalesce(SourceIP, column_ifexists('src',''))), dst = tostring(coalesce(DestinationHostName, Computer, column_ifexists('dst',''))), outcome = tostring(coalesce(EventOutcome, column_ifexists('outcome','')))
  | where isempty(dst) or dst in (appliance_hosts) or Computer in (appliance_hosts);
auth_events
| summarize attempts=count(), successes=countif(outcome has 'success' or msg has 'success'), failures=countif(outcome has 'fail' or msg has 'fail'), first_seen=min(TimeGenerated), last_seen=max(TimeGenerated) by src, dst
| where successes > 0 and (failures >= 10 or attempts >= 25)
| join kind=leftouter (
    SecurityEvent
    | where TimeGenerated >= ago(lookback)
    | where EventID in (4720,4728,4732,4697,7045)
    | summarize host_events=count(), first_host_event=min(TimeGenerated) by Computer, Account
  ) on $left.dst == $right.Computer
| project src, dst, attempts, successes, failures, first_seen, last_seen, host_events, first_host_event
| order by successes desc, failures desc;

Velociraptor VQL

Run this on Windows endpoints and jump infrastructure to identify suspicious processes that reference remote support tooling together with persistence or lateral movement commands.

-- Hunt for remote support context mixed with persistence or lateral movement commands
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(schtasks|localgroup administrators|net user|sc create|New-Service|Set-ItemProperty|reg add|psexec|wmic)'
  AND (Exe =~ '(?i)(beyondtrust|bomgar|remote support)' OR CommandLine =~ '(?i)(beyondtrust|bomgar|remote support)')

Verification and temporary exposure reduction script

This PowerShell does not patch the appliance. It helps a defender inventory BeyondTrust or Bomgar footprint on Windows machines, flag builds at or below 26.2.3 for review, test whether a supplied appliance FQDN has TCP 443 reachable, and write evidence for change control. Run from an elevated admin host and adapt the FQDN list.

# CVE-2026-102764 exposure and inventory helper - run elevated
$ErrorActionPreference = 'SilentlyContinue'
$applianceFqdns = @('remote-support.example.com','support.example.com')
$report = @()

# Check TCP 443 reachability for suspected self-hosted appliances
foreach ($fqdn in $applianceFqdns) {
  $tnc = Test-NetConnection -ComputerName $fqdn -Port 443 -WarningAction SilentlyContinue
  $report += [pscustomobject]@{
    Check = 'ApplianceExposure'
    Target = $fqdn
    Tcp443Open = $tnc.TcpTestSucceeded
    RemoteAddress = $tnc.RemoteAddress
    Detail = 'If open from untrusted networks, restrict immediately and validate patch level'
  }
}

# Inventory installed BeyondTrust or Bomgar related software on the local machine
$paths = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$apps = Get-ItemProperty -Path $paths | Where-Object { $_.DisplayName -match 'BeyondTrust|Bomgar|Remote Support' }
foreach ($app in $apps) {
  $needsReview = $false
  if ($app.DisplayVersion) {
    $needsReview = ([version]$app.DisplayVersion -le [version]'26.2.3')
  }
  $report += [pscustomobject]@{
    Check = 'InstalledSoftware'
    Target = $env:COMPUTERNAME
    Tcp443Open = ''
    RemoteAddress = ''
    Detail = ($app.DisplayName + ' version ' + $app.DisplayVersion + ' review=' + $needsReview)
  }
}

$report | Sort-Object Check, Target
$report | Export-Csv -Path (Join-Path $env:TEMP 'CVE-2026-102764-inventory.csv') -NoTypeInformation
Write-Output ('Evidence written to ' + (Join-Path $env:TEMP 'CVE-2026-102764-inventory.csv'))

Remediation

1. Patch now. Apply the BT26-05-RS patch for BeyondTrust Remote Support as described in Security Advisory BT26-05. If the appliance is on 26.2.3 or earlier but still within a supported release of 24.3.1 or later, apply the vendor fix through emergency change control. If the appliance is older than 24.3.1, upgrade to a supported release first, then patch. Do not expose an unpatched appliance while waiting for a maintenance window.

2. Validate the fix. After patching, confirm the appliance version from the administrative console, confirm vendor patch state, verify services restarted cleanly, and re-test external reachability. Capture before and after evidence: version screenshots, advisory reference, change ticket, firewall state, and validation timestamp.

3. Reduce attack surface. The administrative interface should not be broadly Internet reachable. Put administration behind VPN or zero-trust access, restrict by source IP where business feasible, enforce phishing-resistant MFA for all administrative and representative access, disable unused accounts and API tokens, and segment the appliance from domain controllers and tier-zero assets.

4. Hunt before and after the patch. Review at least the previous 14 days, and longer if exposure was broad. Look for new appliance admins, unusual representative logins, sessions from unknown IP space, session recording gaps, abrupt log rotation, new local accounts, service installs, scheduled tasks, run key changes, credential dumping artifacts, and outbound connections from hosts shortly after support sessions.

5. Rotate exposed secrets. If the appliance was Internet-facing before the fix, rotate credentials with potential blast radius: appliance local admins, directory bind accounts, API clients, service accounts, jump item credentials, stored scripts, SSH keys, and any endpoint local administrator passwords that could have been used through sessions.

6. Monitor for reuse. Add detections for the parent-child process patterns above, watch KEV status, and alert on any new BeyondTrust or Bomgar process ancestry spawning shells, account tools, service control, task scheduler, registry persistence, PsExec-style execution, or remote management protocols.

Authoritative references: CISA alert at https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support, the CISA KEV catalog entry for CVE-2026-102764, and the BeyondTrust Trust Center security advisories hub for Security Advisory BT26-05.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub