BeyondTrust has fixed CVE-2026-102764, a critical flaw (CVSS 9.3) in Remote Support that a Chinese espionage group has exploited since 29 August. It affects self-hosted appliances up to 26.2.3; SaaS customers are already patched. If your company or IT provider runs it on its own servers, apply patch BT26-05-RS today and check for signs of intrusion.
Key facts
- CVE-2026-102764, CVSS 9.3. It is an improper validation of message origin in an internal Remote Support component. It lets a remote attacker perform file operations on the appliance (BleepingComputer).
- Affected versions: Remote Support 26.2.3 and earlier. Patch BT26-05-RS covers 24.3.1 to 26.2.3. If you run a version older than 24.3.1, you must upgrade first.
- Zero-day since 29 August 2026, attributed to Armory Castle (formerly UNC5221 or Warp Panda), according to The Hacker News.
- SaaS customers patched on 8 October according to BleepingComputer, and on 9 October according to The Hacker News and SecurityWeek.
- CISA added it to its KEV catalog of exploited vulnerabilities on 16 October (CISA).
Am I affected if I use BeyondTrust?
It depends on how you run it. If you use Remote Support as SaaS, BeyondTrust has already patched it for you. The risk sits with self-hosted appliances, the ones your IT team or provider installs on its own servers. Without automatic updates, the patch has to be applied manually.
Sources disagree on one detail. SecurityWeek says the August attack hit one BeyondTrust-hosted appliance and one self-hosted appliance; The Hacker News mentions a single self-hosted appliance.
BeyondTrust has also released a patch for Privileged Remote Access (PRA), which shares the affected code. Its internal testing has not found a way to exploit it there.
Remote Support (formerly Bomgar) is mainly used by IT departments and managed service providers (MSPs). If an MSP connects to your machines to support you, this question is for them too.
What did the attackers do once inside?
Researchers attribute the campaign to a suspected Chinese espionage group. According to Mandiant and GTIG, after getting in it deployed the SAWFLY backdoor, a PHP web shell, and the BARECLAW tunnel. It escalated to root and stole credentials from the appliance's secrets store. It then opened remote sessions on internal machines and wiped logs.
A remote support tool holds the keys to the rest of the network. That is why Mandiant warns that any vulnerable appliance reachable from the internet should be treated as potentially compromised until reviewed.
There is another reason not to wait. This group tends to move to mass, opportunistic exploitation once a flaw goes public, and Mandiant does not rule it out here. Its documented targets include legal services, SaaS providers, business process outsourcing (BPO) firms and tech companies.
What to do today
- Ask your IT lead or MSP whether you use BeyondTrust Remote Support or PRA, and whether it is SaaS or self-hosted.
- If it is self-hosted, ask for written confirmation that patch BT26-05-RS is applied. If the version is older than 24.3.1, it must be upgraded first.
- Limit external access to the appliance and restrict admin interfaces to trusted networks, as CISA recommends.
- If it was exposed to the internet, check for compromise since late August: recent remote sessions, admin account permissions and deleted logs.
- If you find signs, isolate the appliance and rebuild it from a clean state. Then apply the patch, rotate every credential the appliance stored or injected, revoke active support sessions and review new MFA registrations on privileged accounts.
What it means for a small business
Many small businesses don't know whether they have this product because they didn't buy it: their IT provider uses it. That makes it a supply chain risk. If your MSP reaches your machines through an unpatched self-hosted Remote Support, an attacker can walk in through the same door as your support team. Ask for confirmation that it is patched and reviewed, not a "don't worry, it's all fine".
The most underestimated point is this: the patch closes the door, but it doesn't remove anyone already inside. If the appliance was reachable from the internet since August, applying BT26-05-RS and moving on is not enough. Rotating credentials is tedious, but it is the part that matters, because what the attackers stole was precisely the secrets store.
The sources give no data on victims in Spain. Your risk depends on whether you use the product, not on where you are. If you want someone to review your remote access and what your providers can touch, that is part of our cybersecurity work.
Frequently asked questions
Is applying the patch enough?
Not if the appliance was exposed to the internet. Mandiant advises treating it as potentially compromised until reviewed, and CISA asks you to rebuild it and rotate credentials if there are signs of compromise.
Do I need to do anything if I use the SaaS version?
BeyondTrust already patched SaaS customers in October. The urgent work is for self-hosted appliances.
Does it affect Privileged Remote Access?
PRA shares the affected code and has a patch, although BeyondTrust has not found a way to exploit it there.
Sources
- CISA – CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
- CISA – CISA Adds Two Known Exploited Vulnerabilities to Catalog
- The Hacker News – China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
- BleepingComputer – BeyondTrust patches zero-day exploited in attacks since August
- SecurityWeek – Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
- The Record – Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
