Surge in Bomgar RMM Exploitation Demonstrates Supply Chain Risk

Researchers at Huntress observed a recent surge exploiting a critical unauthenticated RCE (CVE-2026-1731) in Bomgar/BeyondTrust Remote Support appliances, allowing attackers to gain upstream access to RMM servers, deploy remote management tools (AnyDesk, Atera), create admin accounts, and in several cases deploy LockBit ransomware; incidents have impacted MSPs and multiple downstream customers, demonstrating significant supply-chain risk and prompting recommendations to patch vulnerable systems and monitor for malicious RMM activity.