BeyondTrust Remote Support on KEV: self-hosted appliances vs already-patched SaaS

On 16 Oct 2026, CISA published an alert for CVE-2026-102764 in BeyondTrust Remote Support (formerly Bomgar) and added it to the Known Exploited Vulnerabilities catalog. BeyondTrust’s BT26-05 (15 Oct 2026) is the vendor source of truth for versions and the BT26-05-RS patch.

CISA states actors are actively exploiting the issue for initial access, then persistence, privilege escalation, and lateral movement. That makes the appliance a high-value edge object on authorized assessments — and a BOD 26-04-shaped forensic question for defenders after patching.

Snapshot

Read BT26-05 and the CISA alert for the authoritative wording. This post is engagement sequencing.

Why the SaaS vs self-hosted split matters mid-box

Remote support portals are easy to mis-categorize as “just a vendor cloud.” On engagement:

1. Is it BeyondTrust-hosted SaaS or a customer appliance? SaaS may already be patched per vendor; self-hosted is the urgent path.
2. What version is on the appliance UI? ≤ 26.2.3 is in the affected set.
3. Can the patch land? Pre-24.3.1 needs an upgrade before BT26-05-RS — “we applied a hotfix” may be false if the train is too old.

Industry noise says “BeyondTrust RCE.” Engagement state asks: deployment model, version, exposure, and whether you are authorized to touch it.

Triage questions

1. In ROE? Remote support / break-fix / Bomgar-class appliances authorized?
2. Internet-facing admin/support interfaces? Restrict exposure is an explicit CISA recommendation even after patch awareness.
3. Already patched? SaaS timeline vs self-hosted patch evidence (build string, change window).
4. Compromise window? If exposed while vulnerable, patch alone is not proof of cleanliness — preserve logs before rebuild when IR-authorized (BOD-shaped notes).
5. What do you pause? Unfinished AD/web paths with evidence still deserve a clean pause note.

Operator path

Evidence worth capturing

• Exact product name (Remote Support) and version string before/after remediation
• Deployment model (self-hosted appliance vs BeyondTrust SaaS)
• Network exposure of support/admin interfaces
• If IR-authorized (per CISA guidance themes): unrecognized privileged sessions, unexpected script files, log gaps, unauthorized account/permission/session-policy changes; isolate and image before rebuild when compromise is suspected

Client-facing mitigations (short)

• Self-hosted: upgrade if required, apply BT26-05-RS, confirm auto-update subscription or manual patch discipline
• Limit external access to needed support services; admin interfaces on trusted networks only
• After suspected compromise: rebuild from known-good, rotate credentials the appliance stored/injected, revoke active support sessions, review MFA registrations on privileged accounts (CISA alert sequence)

What not to write

• Treating SaaS tenants as unpatched without checking BeyondTrust’s SaaS statement
• “All BeyondTrust products” when the advisory is Remote Support–scoped
• Invented post-exploitation chains not in your evidence
• Completeness claims without confirming which RS instances exist in scope

Primary sources: CISA alert (16 Oct 2026), BT26-05, and CCCS AL26-025. Re-verify versions on those pages before you file.