A critical CVSS 9.3 flaw in BeyondTrust Remote Support was exploited for weeks before a patch existed. It highlights how exposed remote access tooling has become for smaller organisations.
A critical flaw in BeyondTrust Remote Support, a widely used enterprise remote support platform, was exploited in targeted attacks weeks before a patch existed. The vulnerability, tracked as CVE-2026-102764, carries a vendor-assigned CVSS 4.0 score of 9.3. It stems from improper origin validation in an internal messaging component and affects version 26.2.3 and earlier.
According to the vendor, exploitation began on 29 August 2026 against two appliances, one hosted and one self-managed. The activity was discovered on 28 September, the BT26-05 patch shipped on 8 October, SaaS instances were remediated on 9 October, and the issue was disclosed publicly on 15 October. The US cybersecurity agency CISA urged organisations to patch without delay on 16 October. Mandiant attributes the activity to an espionage group known for targeting internet-facing edge appliances.
Why this matters
Remote support software runs with high privilege by design: it can open sessions, move files and execute commands. One flaw therefore hands an attacker administrator-level access directly. The vendor is explicit that patching alone is not enough — appliances that were internet-facing during the exploitation window should be treated as suspect until they have been reviewed.
The problem is broader than a single product. Endpoint security vendor Huntress reports that in its first-quarter 2026 data, attackers abused legitimate remote management tools in 45% of recorded endpoint incidents, and that this category grew 277% year over year during 2025. Microsoft warned in September 2026 about phishing campaigns that persuade victims to install remote management software themselves. Attackers increasingly skip custom malware and use the tool the organisation already trusts.
What this means for smaller companies
Many small and mid-sized firms rely on remote access software to support branch offices, site teams and remote staff; accounting systems, ERP and camera platforms are often serviced through the same tool. In practice these tools are installed once and forgotten: versions go untracked, and nobody can say who is able to connect to which machine.
There is a regulatory dimension too. Under Turkey's Personal Data Protection Law No. 6698, unauthorised access to a server holding personal data through a remote access tool is a data breach and triggers a notification duty to the Authority. Inadequate technical measures are a recurring theme in the Authority's penalty decisions.
What Kamer Bilişim recommends
- Build an inventory and pin down versions. Write down every remote access product in use, its version and the machines it runs on. Anything not on that list should be removed, and version checks for what remains should become a monthly routine.
- Take management interfaces off the public internet. Admin and login pages for remote support servers should be reachable only from trusted networks or over VPN, protected with multi-factor authentication, with session logs stored off the appliance itself.
- Do not stop at patching — verify. On systems that were internet-facing during the exposure window, look for unexpected administrator accounts, newly installed remote access agents and unusual outbound connections. Where there is doubt, rebuild from a clean image and rotate all administrator, API and integration credentials.
If you would like help inventorying the remote access and support tools in your organisation, checking their patch status or redesigning access policy around them, you can reach us through our contact page.
Source: SOCRadar, CISA, BeyondTrust (BT26-05), Mandiant / Google Threat Intelligence Group, Huntress, Microsoft Security Blog
Source: SOCRadar