BeyondTrust Remote Support Vulnerability Faces Renewed Exploitation Probes
New probes targeting a critical BeyondTrust Remote Support vulnerability suggest attackers may be preparing for widespread exploitation, prompting urgent patching advisories.
Security researchers have detected renewed probing activity targeting CVE-2026-102764, a critical vulnerability affecting BeyondTrust Remote Support. While the probes, originating from a single IP address in Hong Kong, have not yet resulted in confirmed exploitation, their nature suggests potential precursors to mass scanning and exploitation campaigns. This activity underscores the urgency for organizations to patch their internet-facing appliances.
The vulnerability, rated critical with a CVSS score of 9.3, resides in an internal messaging component that failed to properly validate incoming messages. This flaw allows a remote attacker to perform arbitrary file uploads on an affected appliance. BeyondTrust Remote Support versions 26.2.3 and earlier are vulnerable unless the necessary patch, documented in their BT26-05 security advisory, has been applied.
Mandiant previously attributed successful exploitation of this vulnerability in late August 2026 to ARMORY CASTLE, a suspected China-linked espionage group. These zero-day attacks, occurring before public disclosure, involved the deployment of the SAWFLY PHP web shell and led to root privilege escalation. The attackers aimed to access stored credentials and compromise systems managed through the affected appliances.
The recent probing activity, while not yet confirmed as successful exploitation, bears resemblance to known BeyondTrust exploit methods, including a Metasploit module. Researchers noted that the specific requests targeted the /api/start_session endpoint with parameters indicative of session initiation, suggesting attackers are testing publicly available exploit techniques against exposed systems.
BeyondTrust has confirmed that all hosted Remote Support customers were patched by October 9, 2026. For self-hosted customers, the BT26-05-RS patch is available and should be applied immediately to versions 24.3.1 through 26.2.3. Older releases require an upgrade before patching.
CISA has added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the active exploitation and mandating immediate patching for federal agencies. The agency also recommends limiting external access to the Remote Support interface and restricting administrative access to trusted networks.
In response to potential compromise, CISA advises organizations to conduct thorough security reviews. This includes checking for unknown privileged sessions, unexpected scripts, missing log entries, and unauthorized account modifications. If compromise is suspected, immediate isolation of the appliance, preservation of forensic evidence, and a comprehensive recovery process are recommended.
The recovery guidance extends beyond simply applying the patch. It involves rebuilding systems from a known-good state, rotating all appliance-managed credentials, revoking active support sessions, and reviewing new multi-factor authentication registrations to ensure all backdoors left by previous exploitation are closed.