CVE-2026-102764, a CVSS 9.3 flaw in BeyondTrust Remote Support, was exploited as a zero-day for six weeks before a patch existed. CISA urged immediate patching on 16 October.
A critical flaw in enterprise remote support infrastructure was used in targeted attacks well before a patch existed. Tracked as CVE-2026-102764 and rated 9.3 on the CVSS scale, it affects BeyondTrust Remote Support; CISA published an advisory on 16 October 2026 urging organisations to apply the fix without delay.
What happened
The root cause is an origin validation failure in the appliance's internal messaging components, which did not adequately verify where incoming messages came from. The vendor says this allows remote file operations under certain conditions; in the attacks actually observed, that was escalated into arbitrary file upload and then root access on the appliance.
Self-hosted Remote Support 26.2.3 and earlier are affected. Versions 24.3.1 through 26.2.3 need the BT26-05-RS patch applied manually; anything older must first be upgraded to a supported release. Cloud (SaaS) tenants were patched automatically as of 9 October 2026. Privileged Remote Access shares the code base, but no exploitable path was found and a precautionary patch was issued.
Mandiant and Google Threat Intelligence Group attribute the activity to Armory Castle (formerly UNC5221), a suspected China-nexus espionage group that previously used zero-days in Citrix NetScaler and Ivanti Connect Secure. The earliest confirmed exploitation dates to 29 August 2026 — roughly six weeks of active use with no patch available.
Why this matters
A remote support appliance is not an ordinary server. It is the central bridge that governs privileged access to client and employee machines, stores the credentials used to reach them, and brokers the sessions. An attacker who owns it need not break endpoints one by one.
The observed behaviour bears this out. The intruders planted a PHP web shell, ran a SOCKS5 tunnelling tool, modified the load balancer configuration to expose that tunnel to the internet, tried to dump the credential vault, and used stolen administrator accounts to open support sessions into downstream systems and move internal documents out. One detail matters especially: the persistence survives both a reboot and a configuration reset. On-appliance logs were deleted too, so investigation depends on logs shipped off the box.
What this means for mid-sized companies
Most mid-sized companies do not run BeyondTrust. Nearly all run something that does the same job, though: remote support software, a VPN concentrator, an RMM console, or their IT provider's support platform. The lesson is about the product class, not the product name — any component that grants privileged access and faces the internet is a first-tier target today.
There is also an accountability dimension. Under Turkey's data protection framework, the controller stays responsible for an appropriate level of security even on infrastructure it does not own, and access through a support platform creates a notification obligation the moment personal data is reached. And because this exploitation ran quietly for six weeks, "we patched last week" is not by itself a complete answer.
What Kamer Bilişim recommends
- Inventory privileged access and take management interfaces off the public internet. Administrative login pages for remote support, VPN and management consoles should be reachable only through a VPN or jump host. Only end-user client traffic needs to stay internet-facing.
- Rotate credentials after patching, not before. These appliances hold passwords for other systems, so rotating first hands the new secret to the same attacker. The order is patch, investigate, then rotate.
- Ship logs off the appliance and hunt backwards. Look for administrator logins at unusual hours, unknown PHP paths, role changes and gaps in log continuity. Because persistence survives a reboot, rebuilding from a clean, patched image is the only safe option when suspicion cannot be ruled out.
For help inventorying your remote access infrastructure, checking whether management interfaces are exposed, or running a retrospective review of your support tooling, reach us through our contact page. We provide on-site service across the Anatolian side of Istanbul and remote support elsewhere.
Source: The Hacker News (16 October 2026), Beazley Security Labs BSL-A1231 (15 October 2026), SC World (16 October 2026), CISA advisory (16 October 2026)
Source: The Hacker News