The session your help desk opens on a laptop is only useful if you still trust the path that opens it.
On October 16, CISA told organizations that BeyondTrust Remote Support is being actively exploited. That product, formerly Bomgar, is how a lot of IT teams reach a machine they cannot see: a clinician at home, a salesperson in an airport, a teacher between buildings. The alert is about the appliance. The data that appliance was built to reach is still sitting on devices that leave the building.
What CISA flagged this week
CVE-2026-102764 is a critical authentication-bypass flaw in BeyondTrust Remote Support, versions 26.2.3 and earlier. BeyondTrust scored it 9.3. CISA added it to the Known Exploited Vulnerabilities catalog on October 16 because attackers are using it now for initial access, then persistence, privilege escalation, and lateral movement.
The flaw is in how an internal messaging component checks where a message came from. A remote attacker needs no password and no click from an employee. Canada’s Cyber Centre and NHS England both warned the same day that exploitation can lead to unauthorized file operations on the appliance, including file uploads. NHS England also noted that Privileged Remote Access may be affected.
BeyondTrust says its hosted Remote Support customers were patched as of October 9. Self-hosted deployments on versions 24.3.1 through 26.2.3 need the BT26-05-RS patch. Older versions have to be upgraded before that patch will apply. If a compromise is suspected, CISA’s guidance is direct: isolate the appliance, preserve logs, rebuild from a known-good state, rotate every credential the appliance stored or injected, revoke active support sessions, and review new multifactor registrations on privileged accounts.
Three days earlier, on October 13, CISA issued the same kind of warning for Ivanti Connect Secure. CVE-2026-104935 is being exploited for credential theft and data exfiltration. Two remote-access products. One week. The pattern is the path into the organization.
The appliance is not the only copy of the data
Patching the box is the first job. It does not rewind what already happened on the endpoints.
A remote-support session can see the desktop, move files, and hold credentials the appliance injected. If that path was exposed, the laptop at the other end may already have the files, cached logins, and local records an intruder was after. Rotating passwords and killing sessions, which CISA recommends, still leaves the device itself.
And the device is about to move. Client visits, conferences, and holiday travel do not pause for a patch cycle. A laptop in a hotel room or a car is a second copy of the same problem: records you no longer control, on hardware you cannot see.
The same month, a joint advisory, AA26-281A, warned that Chinese government-linked actors are stealing email and credentials from healthcare, education, government, and IT organizations. A remote-access foothold and a laptop that leaves the clinic are two ways the same records walk out. Healthcare systems, schools, and professional firms are exactly the fleets this week’s alerts put in the path.
Patch the appliance. Then decide what happens to every laptop that appliance could already open.
About DriveStrike
DriveStrike is the control you still have over those devices. Locate, lock, wipe, and encryption management sit in one console, with mass deployment for phones, tablets, and computers on Windows, macOS, Linux, iOS, Android, and ChromeOS. If you want a walkthrough before you put it on the fleet, talk to the team.
What to do this week
Do the appliance work first. DriveStrike does not patch BeyondTrust or Ivanti. Your team still has to:
- Find every self-hosted Remote Support deployment and confirm whether it is on version 26.2.3 or earlier
- Apply the BT26-05-RS patch where the version allows it, and upgrade first where it does not
- If the appliance may have been exposed, isolate it, rebuild it, and rotate the credentials it stored or injected
- Revoke active support sessions and check new multifactor registrations on privileged accounts
- Treat the October 13 Ivanti Connect Secure alert the same way if you run those appliances
Then deal with the devices those tools could already open.
DriveStrike is built for that second job.
- Locate a missing laptop, tablet, or phone from one console
- Lock it so a stranger cannot keep using it
- Wipe company data if the device is not coming back, or if you no longer trust what is on it
- Manage encryption, including BitLocker, so a drive pulled from a bag is not an open folder
- Geofence devices so action can start when they leave where they should be
- Cover the fleet across Windows, macOS, Linux, iOS, Android, and ChromeOS
- Deploy at scale, instead of protecting one machine at a time
That is the difference between closing a vendor ticket and knowing the laptop in someone’s trunk is already locked down. HIPAA- and GDPR-aligned controls matter more when a missing device can become a reportable incident, not just a hardware ticket.
Do this before the next laptop leaves
The patch window is open. The travel window is opening behind it. A help-desk tool under active exploitation is an urgent ticket. The laptop that tool could already see is the part you can still put under your control today.
The devices still in your hands are the ones you can protect before they hit an airport, a hotel, or a home office. Thirty days is enough to put locate, lock, wipe, and encryption on the machines you would hate to lose while these alerts are still fresh.
Start Your Free 30 Day Trial
CISA is warning that the path into your laptops is being exploited. Start a free DriveStrike trial and put locate, lock, wipe, and encryption on the devices those sessions can already reach.