Critical 9.3Being exploited
BeyondTrust · Remote Support · CVE-2026-102764
BeyondTrust Remote Support appliances breached without a login
Internal components of BeyondTrust Remote Support did not check where messages came from, letting an unauthenticated attacker perform file operations on the appliance and, in practice, take it over. BeyondTrust confirmed compromises dating back to 29 August, and Mandiant attributes them to a suspected China-linked espionage group. Remote-support tools are a common route for attackers into an IT provider's customers.
- Affected
- BeyondTrust Remote Support 26.2.3 and earlier, self-hosted. BeyondTrust patched its SaaS service by 9 October. Self-hosted Privileged Remote Access shares the affected code.
- What to do
- Self-hosted customers on 24.3.1 to 26.2.3: apply the BT26-05-RS patch now. Older versions: upgrade to a supported version first, then patch. Then check the appliance for signs of compromise and rotate any credentials it stores, as patching does not remove an attacker already present.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
- Why it’s here
- Exploited as a zero-day; on CISA's KEV list; IT support providers widely use remote-support tools to reach client machines.