A critical flaw in BeyondTrust Remote Support, CVE-2026-102764, was exploited as a zero-day from late August before it was disclosed. The case shows that remote support tooling is itself part of the attack surface.
On 15 October 2026 BeyondTrust disclosed a critical flaw in Remote Support, its enterprise remote support appliance. The issue, tracked as CVE-2026-102764, carries a CVSSv4 score of 9.3. It lets an unauthenticated attacker perform file operations on the appliance — in practice, uploading a file to an internet-facing support server without knowing a password.
More significant is that the flaw was in use before anyone knew about it. According to BeyondTrust's own report, two known compromises date back to 29 August 2026: one vendor-hosted instance and one customer-operated appliance. The hosted incident was found and contained on 28 September. Google's threat intelligence arm, Mandiant, attributes the activity to ARMORY CASTLE, a group previously tracked as UNC5221. The US cybersecurity agency CISA added the flaw to its known exploited vulnerabilities catalogue on 16 October and gave federal agencies until 19 October to patch.
Why this one is different
The problem is not a single product but a whole class of them. Remote support and remote access tools are privileged by design: they reach into user machines, store administrative accounts and act as a jump point into servers. The intrusion chain Mandiant documented used exactly that. After planting a web shell on the appliance, the attackers escalated to root, dumped the administrator credentials held in the appliance's own vault, raised their own permission roles and then used ordinary support sessions to reach machines on the internal network. Logs were deleted on the way out.
The practical consequence is that patching alone does not close the case. Both BeyondTrust and Mandiant advise treating any appliance that was internet-facing and unpatched during the exploitation window as presumed compromised: rebuild it from a clean image and rotate credentials after that work, not before. Rotating passwords while an attacker still has access simply hands over the new ones.
What it means for smaller companies in Turkey
Most small and mid-sized businesses in Turkey do not run BeyondTrust Remote Support. Almost all of them, however, run something equivalent: an RMM agent belonging to their IT provider, a VPN box, a jump server, a free remote desktop utility, or an RDP port published straight to the internet. These tools rarely appear on an inventory, rarely have their own patch schedule, and often share one password. That is the layer this attack targeted.
There is a data protection angle too. If an intruder reaches the internal network through a support tool, systems holding personal data may have been reached as well, which can trigger the data controller's duty to notify the Turkish data protection authority. That makes retained access logs and a written incident response plan as important as the patch itself.
What Kamer Bilişim recommends
- Build a remote access inventory. Put every tool that can reach your network from outside on one list: RMM agents, VPN appliances, remote desktop software, exposed RDP and VNC ports, and any accounts your suppliers use. You cannot patch or switch off something that is not on the list.
- Take management interfaces off the public internet. Admin panels for support and network devices should be reachable only over VPN or from a restricted set of IP addresses. Require multi-factor authentication for administrative logins, and give supplier accounts their own named, time-limited credentials.
- Plan for breach separately from patching. Ship logs from critical appliances to a central location off the device, assign one person to watch vendor advisories with an agreed maximum response time, and test at least once a year that your backups can actually restore a clean version of a compromised system.
We provide network infrastructure, firewall, server management and managed IT contracts across the Anatolian side of Istanbul. If you would like to review your remote access setup together, you can reach us through our contact page.
Source: BeyondTrust security advisory (BT26-05), Google Threat Intelligence / Mandiant, CISA and Rapid7 analyses.
Source: CISA