Critical remote support flaw exploited weeks before the patch

A critical authentication bypass in BeyondTrust Remote Support was used in live attacks weeks before a fix was available. On 16 October 2026 the US cybersecurity agency CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalogue and gave federal agencies until 19 October to patch.

What happened

According to the vendor's BT26-05 security advisory, internal components of the product fail to properly validate where incoming messages originate. That lets an unauthenticated attacker perform file operations on the appliance with no user interaction at all. Rapid7's write-up puts the CVSS v4 score at 9.3 and lists Remote Support 26.2.3 and earlier as affected.

The timeline matters as much as the flaw. The vendor says the first two breaches happened on 29 August 2026, the activity was detected on 28 September, and the patch shipped on 8 October — roughly six weeks of quiet exploitation. Mandiant, which handled the incident response, attributes the activity to an espionage-focused threat group. Cloud (SaaS) instances were patched automatically; self-hosted customers have to apply the update themselves.

Why it matters

Remote support and remote access tools sit in a privileged position by design. They connect legitimately to a large share of the systems in an organisation, and they frequently store or inject credentials. In this case, Rapid7 reports that attackers planted a web shell and a tunnelling tool on the appliance, escalated to root, attempted to read the credential vault, and deleted logs to cover their tracks.

The lesson is not about one brand. Every management interface exposed to the internet — a remote support console, an RMM dashboard, a VPN appliance, a firewall portal — is a single door onto many systems. Patching alone is not enough either: the vendor states plainly that the fix does not remove persistence an attacker may already have established, so a post-patch investigation is required.

What this means for smaller businesses

Most small and mid-sized companies in Turkey are unlikely to run this particular product, but they do run tools that play the same role: remote desktop connections, RMM agents, VPN appliances, camera and NVR interfaces, server and storage panels. These share one trait — installed once, running for years without updates, and often absent from any asset inventory.

There is a compliance angle too. Under Turkey's data protection law (KVKK), access to systems holding personal data through a remote access component triggers a breach notification obligation for the data controller. The fact that this intrusion went unnoticed for a month underlines that detection time deserves as much attention as prevention.

What we recommend at Kamer Bilişim

• Inventory every management interface facing the internet. Work out which remote desktop, VPN, firewall portal, NVR, printer and server panels are reachable from outside. Close everything that does not strictly need external access, and put the rest behind an IP allow-list or a VPN.
• Give remote access components their own patch schedule. Teams that keep servers and workstations current routinely overlook network gear and support tooling. Subscribe to vendor security advisories for these products and define a maintenance window that lets you apply a critical fix the same day.
• Ship logs off the device, and verify after patching. Deleting local logs is one of the first things an attacker does. Forward appliance logs to a central server, and after any critical patch review privileged accounts, session records and unexpected files — rotating stored credentials where there is any doubt.

If you cannot say which management interfaces at your sites on the Anatolian side of Istanbul are reachable from the internet, mapping that external surface is the fastest first step. Kamer Bilişim has managed corporate networks, servers and firewalls since 2006 — to have your setup reviewed, reach us through our contact page.

Source: Rapid7 — "CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild"; BeyondTrust security advisory BT26-05; CISA Known Exploited Vulnerabilities catalogue, 16 October 2026.