What is Remote Support?

Remote Support is BeyondTrust software for remote access to systems. Support teams use it to fix machines from afar. It holds privileged access by design. That access is why this flaw matters.

Am I affected if I use SaaS?

No. BeyondTrust patched SaaS customers by October 9, 2026. Self-hosted customers must apply the patch. Check your version first.

CISA urges patching right away. It also urges network and memory forensics on self-hosted appliances. Forensics checks whether exploitation already happened. Do both, not one alone.

ResourcesBlog

BeyondTrust Remote Support Flaw Hits CISA KEV: Patch Now

BeyondTrust published advisory BT26-05 on October 15, 2026. It fixes a 9.3 flaw in Remote Support. CISA lists it as actively exploited.

Leonard EserePublished 2026-10-26Reading time 5 min

Filed underBeyondTrust Remote Support KEV privileged access governance

BeyondTrust Remote Support Flaw Hits CISA KEV: Patch Now

Summary

BeyondTrust published advisory BT26-05 on October 15, 2026.
The flaw scores 9.3 under CVSS version 4.0.
A remote attacker with no login can run file operations.
All Remote Support versions 26.2.3 and earlier are affected.
CISA added it to the KEV catalog on October 16, 2026.
CISA says threat actors are actively exploiting the flaw.

A 9.3 flaw with active exploitation

BeyondTrust published security advisory BT26-05 on October 15, 2026. It covers Remote Support, the remote access appliance. The flaw scores 9.3 under Common Vulnerability Scoring System (CVSS) version 4.0. A remote attacker with no login can perform file operations on the appliance. The weakness is Common Weakness Enumeration (CWE) 290, improper origin validation. It sits in an internal messaging component.

The flaw

Common Vulnerabilities and Exposures (CVE) is the public record system.

CVE-2026-102764 is an improper origin validation flaw. A remote attacker with no login can perform file operations on the appliance. No login means no stolen password is needed. Network reach alone opens the door.

Who is affected

All Remote Support versions 26.2.3 and earlier are affected. SaaS customers are already patched. BeyondTrust patched SaaS by October 9, 2026. Self-hosted versions 24.3.1 and later can apply patch BT26-05-RS. Versions older than 24.3.1 must upgrade first. Then they can apply the patch.

CISA says it is exploited

The Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog. That listing came on October 16, 2026. The due date was October 19, 2026. CISA issued an alert the same day. CISA says threat actors are actively exploiting the flaw. They use it to gain initial access. Then they establish persistence, escalate privileges, and move laterally. CISA urges patching plus network and memory forensics on self-hosted appliances.

What to do this week

First, check whether you run self-hosted Remote Support. Record the version on each appliance. Second, apply patch BT26-05-RS if your version allows it. Third, upgrade first if you run an older version. Fourth, run the network and memory forensics CISA urges. Fifth, keep the dated patch and forensics records.

The governance lesson

Remote access tools hold the keys to your systems. They are high value targets by design. A flaw here is not a flaw in a side tool. Your evidence file should hold five items. It should list each appliance with its version. It should record the patch date per appliance. It should hold the forensics result. It should note any upgrade done first. An assessor can follow that file without asking twice.

Sources

BeyondTrust security advisory BT26-05, BT26-05, October 15, 2026.
CISA alert, CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support, October 16, 2026.
CISA Known Exploited Vulnerabilities catalog, Known Exploited Vulnerabilities Catalog, listing dated October 16, 2026.
CVE-2026-102764 record, CVE Program.
National Vulnerability Database record for the flaw above.
Original diagram by PolicyCortex.

Next step

Want patch evidence linked to each control, without chasing spreadsheets? See how PolicyCortex collects it from live systems.

Questions on this record

What is Remote Support?: Remote Support is BeyondTrust software for remote access to systems. Support teams use it to fix machines from afar. It holds privileged access by design. That access is why this flaw matters.
Am I affected if I use SaaS?: No. BeyondTrust patched SaaS customers by October 9, 2026. Self-hosted customers must apply the patch. Check your version first.
What does CISA urge?: CISA urges patching right away. It also urges network and memory forensics on self-hosted appliances. Forensics checks whether exploitation already happened. Do both, not one alone.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state: Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change: Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency: Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture: Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.