Back
BeyondTrust Remote Support flaw: When the support tool becomes the attack path
On 15 October 2026, BeyondTrust disclosed a critical flaw in its Remote Support (RS) product that allows file operations on the appliance without logging in. The first known compromises date back to 29 August; CISA added the flaw to its KEV catalog on 16 October.
Because remote support tools run with broad access to the corporate network, this flaw is particularly dangerous.
The vulnerability
| Field | Details |
|---|---|
| CVE | CVE-2026-102764 (BeyondTrust advisory BT26-05) |
| Type | Authentication bypass (CWE-290); internal components do not verify the origin of incoming messages |
| CVSS v4.0 | 9.3 — remote, unauthenticated, no user interaction |
| Affected | Remote Support 26.2.3 and earlier without the BT26-05-RS patch; self-hosted Privileged Remote Access uses the same code |
| Cloud (SaaS) | BeyondTrust says all RS SaaS customers were patched as of 9 October |
What did the attackers do?
Mandiant attributes the attacks to ARMORY CASTLE (formerly UNC5221), a group assessed to be China-nexus. Observed activity: unauthorised file uploads, deployment of a PHP web shell and a tunnelling tool, privilege escalation to root, attempts to extract the credential vault, persistence and log deletion.
What should you do?
- Patch self-hosted RS immediately. The BT26-05-RS patch is available for versions 24.3.1 to 26.2.3; older versions must first be upgraded to a supported release. If you run PRA, confirm the right patch with BeyondTrust support.
- Investigate even after patching. The patch does not remove an attacker who has already established persistence. Review admin sessions from residential or commercial VPN addresses, unexpected scripts in web directories, changes to permissions and session policies, and gaps in log forwarding.
- Preserve evidence. Collect logs before making changes or rebooting, and isolate the suspicious appliance.
- If compromise is confirmed or cannot be ruled out, rebuild the appliance from a clean, patched image and change every credential stored in or passed through RS.
- Forward logs to an external SIEM. Even if the attacker wipes the logs on the appliance, you keep a copy.
How Nokta Guard can help
We assess your remote access and privileged access tools from both outside and inside as part of a penetration test. On appliances suspected of compromise, a forensic examination determines which systems the attacker reached.
Related services: Internal Network Penetration Testing, Evidence Integrity Assessment
Sources: Rapid7