Federal civilian agencies have until 19 Oct to fix it. BeyondTrust patched its SaaS customers by 9 Oct; self-hosted appliances need the BT26-05 patch now.
The US Cybersecurity and Infrastructure Security Agency added CVE-2026-102764, a flaw in BeyondTrust Remote Support (formerly Bomgar), to its Known Exploited Vulnerabilities catalog on Friday and gave federal civilian agencies until 19 October to remediate. BeyondTrust’s advisory BT26-05, issued Thursday, rates the bug critical with a CVSSv4 score of 9.3 and says it could let a remote attacker perform file operations on an appliance; all versions up to 26.2.3 are affected. BeyondTrust says all Remote Support SaaS customers were patched as of 9 October, so the action is on self-hosted appliances: apply the BT26-05-RS patch, upgrading first if on a version older than 24.3.1. CISA says attackers are using the flaw for initial access, then persistence, privilege escalation and lateral movement. CISA also advises limiting external access and investigating self-hosted appliances for compromise; where compromise is suspected, it says to isolate the appliance, rebuild from a known-good state and patch, then rotate every credential the appliance stored or injected, revoke all active support sessions and review new multifactor authentication registrations on privileged accounts. Mandiant says it found the bug exploited as a zero-day from late August by ARMORY CASTLE, formerly tracked as UNC5221, which Mandiant describes as a suspected PRC-nexus espionage threat actor. CISA also added CVE-2025-61624, an authenticated path-traversal flaw in several Fortinet products that Fortinet fixed in April. CISA lists ransomware use as unknown for both.
Sources: CISA: two KEV additions · CISA: BeyondTrust alert · CISA KEV catalog · BeyondTrust BT26-05 · Fortinet PSIRT · Mandiant / Google Threat Intelligence · The Record