BeyondTrust Remote Support was exploited since August
A remote support zero-day was used by suspected espionage actors for weeks before the patch. Self-hosted appliances need patching and checking.
BeyondTrust disclosed yesterday a critical authentication bypass in Remote Support (CVE-2026-102764) affecting versions 26.2.3 and earlier. The patch, BT26-05, came out on 8 October and was applied automatically to cloud-hosted instances. Self-hosted appliances need it applied manually if automatic updates are off.
The uncomfortable part: Google’s threat intelligence team says the bug was first exploited on 29 August, by a suspected China-nexus espionage group. CISA added it to its exploited list today.
- Patch self-hosted appliances now, and confirm the version afterwards.
- Follow Mandiant’s advice: if an appliance was reachable from the internet on a vulnerable version, treat it as possibly compromised until reviewed.
- Review sessions, new accounts and configuration changes since late August.
- Rotate credentials stored in the appliance’s vault.
Remote support tools reach everything. This is the second BeyondTrust zero-day this year.