CISA has identified a critical authentication bypass vulnerability, CVE-2026-102764, affecting BeyondTrust Remote Support versions up to 26.2.3. This vulnerability is actively exploited by cyber threat actors for initial access and subsequent network compromise. CISA has added this CVE to its Known Exploited Vulnerabilities catalog. Organizations using self-hosted Remote Support appliances must immediately apply the BT26-05-RS patch after upgrading to a supported version if necessary. BeyondTrust-hosted deployments have already been patched. It is crucial to limit external access to Remote Support appliances and restrict administrative interfaces to trusted networks. Affected organizations should conduct network and memory forensics to detect potential compromises. If a compromise is suspected, isolate affected appliances, collect forensic data, and forward logs to the SIEM. Further investigations should hunt for indicators of threat actor activity and unusual system changes. After rebuilding from a known-good state and patching, all credentials handled by the appliance must be rotated. CISA strongly advises reviewing BeyondTrust's security advisories and related resources for complete mitigation strategies.