A newly disclosed serious vulnerability affecting BeyondTrust Remote Support is now under active probing, signaling possible expansion from targeted espionage to broader attacks. The flaw, tracked as CVE-2026-102764 and rated “critical” with a CVSS score of 9.3, impacts Remote Support versions 26.2.3 and earlier in unpatched internet-facing deployments.
Early Probes and Attack Tactics
Security researchers observed two probing attempts against decoy appliances in the U.S. and Europe, both originating from the same IP address in Hong Kong. These probes—targeting the POST /api/start_session endpoint—carried parameters such as issue_menu=1, id=1, c2cjs=1, and platform=thin. Such traffic resembles a Metasploit module under review, though it falls short of being a confirmed match, suggesting attackers might be experimenting with publicly available exploit tools against vulnerable systems. So far, no successful exploitation has been reported in these probes.
Zero-Day Exploits and Known Threat Actors
The vulnerability involves a messaging component that fails to adequately verify the origin of incoming messages. When leveraged, this allows remote attackers to perform arbitrary file operations on the affected appliance. Earlier, this flaw was exploited as a zero-day by the China-linked espionage group “Armory Castle” (formerly UNC5221), enabling them to upload files before the weakness was made public. In those cases, attackers deployed a PHP web shell—known as “SAWFLY”—and escalated privileges to root. The intrusions also enabled access to stored credentials and systems managed via compromised appliances.
Patch Status and Cybersecurity Guidance
Self-hosted customers are urged to apply the BT26-05-RS patch immediately. It applies to versions 24.3.1 through 26.2.3; versions older than 24.3.1 must be upgraded before patching. Hosted deployments of Remote Support have already been updated as of October 9, 2026.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) formally added this issue to its Known Exploited Vulnerabilities catalog on October 16, 2026, and issued alerts to limit external exposure and restrict administrative interfaces to trusted networks. CISA also recommends examining logs for unknown privileged sessions, unexpected script deployments, missing logs, and unauthorized permission or account changes.
Recommended Response for Affected Organizations
For organizations that suspect they have been compromised, it’s advised to isolate affected appliances, preserve forensic evidence, rebuild from trusted backups, and rotate credentials managed by those appliances. Support session revocations and audits of any new multi-factor authentication registrations are also essential to mitigate ongoing risks.
The renewed probes show the urgency of patching and hardening defenses without delay. Even though current activity appears limited and successful exploitations—beyond earlier espionage cases—haven’t been reported lately, the similarity to known exploit modules suggests battle lines are being drawn. What to watch: whether the attack origins multiply, exploit code becomes public, or attackers begin broad scanning campaigns rather than one-off probes. That shift could mark the difference between isolated incidents and mass compromise across exposed systems.
