Hackers Exploit Critical Remote Support Security Flaw Before Public Disclosure
A critical security vulnerability affecting BeyondTrust Remote Support has been discovered after hackers exploited the weakness to gain unauthorized access to business systems.
The vulnerability, identified as CVE-2026-102764, was publicly disclosed on 15 October 2026. It carries a critical severity rating of 9.3 out of 10.
According to investigations by BeyondTrust and Google's Mandiant cybersecurity team, attackers exploited the vulnerability in August 2026, weeks before the public disclosure.
The attacks have been linked to a suspected China-connected cyberespionage group known as ARMORY CASTLE.
HOW DOES THE VULNERABILITY WORK?
BeyondTrust Remote Support is software used by IT teams to access computers and provide technical assistance remotely.
The vulnerability affects an internal messaging component that does not properly verify the origin of certain messages.
Under specific conditions, an attacker can exploit this weakness to perform unauthorized file operations on a vulnerable system without needing valid login credentials.
Successful exploitation can allow attackers to upload malicious files and potentially gain control of the affected appliance.
Because remote support systems often connect to other computers within an organization, compromising one of these systems can create additional security risks.
WHAT DID THE ATTACKERS DO?
Mandiant's investigation found that the attackers used the vulnerability to gain access to affected systems and establish ways to maintain that access.
The attackers deployed malicious tools, including software designed to provide remote access and create hidden communication channels.
Investigators also identified attempts to access stored credentials and expand access to connected systems.
These activities demonstrate why remote access infrastructure is an attractive target for cybercriminals and espionage groups.
WHO IS AFFECTED?
According to BeyondTrust, the vulnerability affects Remote Support versions up to and including 26.2.3.
The company released security patch BT26-05-RS to address the problem.
Cloud-hosted Remote Support customers received the security update automatically by 9 October 2026.
Organizations running their own Remote Support installations must confirm that the patch has been installed.
Systems running versions older than 24.3.1 must first upgrade to a supported version before applying the patch.
WHAT SHOULD ORGANIZATIONS DO?
BeyondTrust and Mandiant recommend that affected organizations install the security patch immediately.
IT administrators should also review their systems for signs of unauthorized access.
Organizations that suspect their systems were compromised should investigate carefully because installing a patch does not automatically remove malware or unauthorized access established before the update.
Security teams may also need to replace compromised credentials and rebuild affected systems.
WHY THIS MATTERS
Remote support software plays an important role in modern IT operations. Businesses, hospitals, government institutions and technology companies depend on remote access tools to maintain their systems.
However, these tools can also become valuable targets for attackers because they often have access to sensitive computers and information.
This incident shows how a single vulnerability in remote access infrastructure can create risks across an entire organization.
It also highlights the importance of installing security updates, monitoring unusual activity and protecting privileged accounts.
Although investigators have linked the attacks to a suspected China-connected espionage group, this attribution remains an assessment based on technical evidence.
BeyondTrust has released patches, but organizations must still confirm that their systems are protected.
OFFICIAL SOURCES
BeyondTrust Security Advisory:
https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
BeyondTrust Security Investigation:
https://www.beyondtrust.com/blog/entry/bt26-05