A China-linked group used a BeyondTrust flaw from 29 August. Self-hosted boxes must patch.
By Lior AharonovFounder, 7IT Solutions ·
On Friday, 16 October 2026, CISA added CVE-2026-102764, a CVSS 9.3 authentication bypass in BeyondTrust Remote Support up to 26.2.3, to its exploited list, due 19 October. SecurityWeek reports exploitation began on 29 August, and Mandiant ties it to the espionage group Armory Castle. BeyondTrust patched SaaS customers on 8 October; self-hosted appliances need the fix applied.
A remote support box holds a path into every machine your helpdesk touches. Attackers who came in through it planted a webshell, wiped logs and moved on with admin credentials, BleepingComputer reports.
If you run self-hosted BeyondTrust Remote Support or Privileged Remote Access, apply the BT26-05 patch today, then treat any internet-facing appliance left unpatched since late August as possibly compromised and review it.
Five weeks of quiet attacks before the cloud fix. Self-hosted means you are the patch team.
Lior Aharonov · my takeSources
- BleepingComputer: BeyondTrust patches zero-day exploited in attacks since August bleepingcomputer.com
- SecurityWeek: Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day securityweek.com
- CISA Known Exploited Vulnerabilities catalog (JSON, main branch) raw.githubusercontent.com
Researched with AI tools; every fact is checked against the linked sources.