Policy

The BeyondTrust bug was used before the patch. Check the logs.

CISA listed BeyondTrust Remote Support CVE-2026-102764 on October 16 with forensic triage required. BeyondTrust says it was exploited as a zero-day on August 29.

Edited by Emilio Santos 6 min read
A desk lit at night in an empty office
A remote-support box holds the keys to everything it reaches. Photo: Circuit & Capital

On Thursday, October 15, 2026, BeyondTrust published security advisory BT26-05 for its Remote Support product. The flaw is CVE-2026-102764, scored 9.3 on CVSS version 4 and rated Critical. BeyondTrust describes it as improper origin validation in an internal messaging component that could let a remote attacker perform file operations on an affected appliance. Every Remote Support version up to and including 26.2.3 is affected. The next day, October 16, the Cybersecurity and Infrastructure Security Agency added the CVE to its Known Exploited Vulnerabilities catalog. The catalog row carries a federal due date of October 19 and marks forensic triage as Yes.

The patch is the easy part. BeyondTrust’s own account says the bug was used as a zero-day in late August, nearly seven weeks before the advisory. If you, or a supplier that reaches into your network, run a self-hosted appliance, the question this week is not only “are we patched?” It is “was the box used before we patched, and could we tell?”

What happened, in order

BeyondTrust’s blog post on BT26-05, last updated October 16 at 12:00 p.m. EDT, gives this timeline:

  • August 29, 2026: an actor exploited the zero-day against one BeyondTrust-hosted Remote Support instance and one self-hosted Remote Support appliance.
  • September 28: BeyondTrust’s threat hunting found indications of the event at the hosted customer. The company says it contained the instance within 27 minutes of first detection.
  • September 30: Mandiant shared findings from the self-hosted customer that matched BeyondTrust’s own.
  • October 8: BeyondTrust released the BT26-05 patch. Hosted instances of Remote Support and Privileged Remote Access were patched automatically. The advisory itself says the patch had been applied to all Remote Support SaaS customers as of October 9.
  • October 15: coordinated public disclosure of the CVE, the advisory, the blog and Mandiant’s analysis.

As of the October 16 update, BeyondTrust says it knows of only those two affected customers and has seen no adversary activity since August. It assesses with moderate to high confidence that the actor is the China-nexus cluster Mandiant and Google Threat Intelligence Group track as UNC5221, which Mandiant now calls ARMORY CASTLE. It also warns that this actor tends to use a zero-day selectively and then, once the flaw is public, move to broad exploitation of every instance still unpatched.

Two details matter for buyers. Privileged Remote Access shares the affected code; BeyondTrust found no way to exploit it there but released the patch for it anyway. And self-hosted Remote Support customers without automatic updates must patch by hand, after first upgrading if they are older than 24.3.1.

Why the catalog row says forensic triage

The catalog entry links to Binding Operational Directive 26-04, which CISA issued on June 10, 2026. It binds only federal civilian agencies, but it is the clearest public statement of how the government ranks urgency. It asks four questions: is the asset publicly exposed, is the CVE in the catalog, can an attacker automate the exploit, and does the attacker gain partial or total control. For the top tier, an agency must remediate within three days and carry out a forensic triage to check whether the system was already compromised.

CISA’s implementation guidance sets recommended, not mandatory, targets: scoping within two hours of the catalog addition, evidence collection and patching within 24 hours, and an escalation decision within 48 to 72 hours. Evidence comes first, because patching can destroy it.

BeyondTrust’s account explains why that order is right here. It says the actor planted a web shell, escalated to full administrative control within minutes, installed persistence designed to survive a reboot, read the appliance’s stored secrets, and then deleted logs and its own tools before leaving. Evidence kept only on the appliance “may not survive,” the company writes, and what is there “cannot be implicitly trusted.” Logs forwarded off the box are what count.

The same week on the catalog

BeyondTrust was one of nine additions to the catalog between October 13 and October 16. CISA added Ivanti Connect Secure CVE-2026-104935 and Windows CVE-2026-96951 on October 13; Palo Alto Networks PAN-OS CVE-2026-0322, Cisco Secure Email Gateway CVE-2026-76519 and two AhsayCBS backup-server flaws, CVE-2026-105133 and CVE-2026-105134, on October 14; an Atlassian Data Center file-access flaw, CVE-2026-21589, on October 15; and Fortinet CVE-2025-61624 alongside BeyondTrust on October 16. Six more, four of them Plex Media Server, followed on October 20. Every one of the nine October 13 to 16 rows, apart from AhsayCBS CVE-2026-105133, is marked for forensic triage.

As in the October 1 catalog briefing and the NetScaler note, most of the list sits at the network edge: VPNs, firewalls, email gateways, remote access and backup servers.

What it means for CISOs

A remote-support appliance is privileged access by design. BeyondTrust says so plainly: the appliance “stores and brokers privileged credentials across an estate,” which makes it both a credential source and a map of who connects to what. Treat a compromise of one as a compromise of every credential it injected.

The second lesson is about your detection stack. BeyondTrust says its sensors fired in real time when the attacker escalated privileges, but the automated triage feature in a third-party detection platform closed those alerts as false positives. The company is now working with that vendor so automated triage cannot close high-severity signals on its own. Ask your managed detection provider, in writing, which high-severity alerts its automation can close without a person.

What it means for CFOs

The exposure is often not your own appliance. Managed service providers, outsourced IT desks and software vendors use remote-support tools to reach their customers. If one of them runs self-hosted Remote Support, your systems sit one hop away from a box that was exploited as a zero-day. That is a third-party risk question with contract consequences: notification clauses, audit rights and who pays for forensic work.

Forensic triage costs money even when it finds nothing; budget for it as part of patching. If you carry cyber insurance, check now whether the notice clause is triggered by a suspected incident or only a confirmed one, and whether the insurer requires its own forensics firm. For a public company, a confirmed compromise also raises the Form 8-K question. The four-business-day clock under Item 1.05 starts at the materiality determination, not at the advisory date; the SEC clock briefing and the 8-K materiality worksheet cover how to record that decision.

What to do this week

  1. Find every instance. List self-hosted BeyondTrust Remote Support and Privileged Remote Access appliances, their versions, and whether automatic updates are on. Anything at 26.2.3 or below without the BT26-05 patch is exposed. Anything below 24.3.1 needs an upgrade first.
  2. Preserve before you patch, where you still can. Image the appliance and export its logs, then apply the patch.
  3. Get logs off the box. Forward appliance syslog and session events to your SIEM, as BeyondTrust recommends. Look back to at least August 29, the first exploitation date it gives.
  4. Hunt for behavior, not indicators. BeyondTrust’s list: privileged sessions from residential broadband or commercial VPN addresses you cannot tie to a known administrator or ticket; unrecognized script files in web directories; web service accounts spawning shells; unexpected permission changes to Jump Items or Teams; and gaps in log forwarding that start and end within a single session.
  5. Rotate if anything looks wrong. Rotate every credential the appliance stored or injected, review new multi-factor registrations on privileged accounts, and watch those accounts for logins outside managed sessions.
  6. Ask your suppliers. Send each MSP and IT vendor with remote access one question: do you use self-hosted BeyondTrust Remote Support or Privileged Remote Access to reach us, and on what date did you apply BT26-05? Record each answer with the date and the name of the person who gave it, so “we’re patched” is a dated fact rather than an assurance.
  7. Do not waive it. If patching slips, record the owner and expiry in the risk exception register, and confirm owners for the week’s other rows you run.

What to watch next

BeyondTrust says it is withholding technical details while self-hosted appliances are still being patched. When those details are published, expect wider exploitation of anything left unpatched, which is the pattern the company itself predicts for this actor. Watch the BT26-05 blog and the catalog row for changes. Under BOD 26-04, federal agencies’ Phase III deadline, 180 days from issuance, falls on December 7, 2026 by our count; agency patch reporting will keep edge-device rows in the news through year-end.

Sources

Related: PHP2Shell was probed before the patch (October 22), Citrix NetScaler is on the exploited catalog again, CISA listed three bugs attackers are already using, and the guide Limit what an agent can touch, which applies the same least-privilege logic to automated access.

ES
Emilio Santos edits Circuit & Capital. How we source and correct pieces: editorial standards.
circuits50capital@circuits.fit