SecOraLens
CriticalZero-Day

BeyondTrust patches zero-day exploited in attacks since August

BleepingComputer·Source published ·1 min read·Video available
Advisory videoOpen on YouTube ↗

What happened?

BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]

Key details

  • BeyondTrust alerted customers to a critical Remote Support flaw that has been exploited in zero‑day attacks since late August.
  • The CVE‑2026‑102764 authentication bypass lets unprivileged remote attackers perform file operations on unpatched appliances and impacts Remote Support 26.2.3 or earlier.
  • Any internet‑exposed appliance running a vulnerable version during the exploitation window should be assumed potentially compromised until reviewed.
  • Shadowserver reports over 1,400 BeyondTrust remote support instances are exposed online, though the number secured or honeypots is unknown.

Affected

  • Privileged Remote Access SaaS customers are affected by the same vulnerability.

Fixes and mitigations

  1. SaaS customers received a patch on October 8 to remediate the vulnerability.

What to look for

  • Deployment of Sawfly web shell and Bareclaw tunneler malware.
  • Opening remote sessions on downstream systems using compromised administrator credentials.

Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories