Urgent awareness alert. This is awareness content, not a monitored threat intelligence service: always check vendor advisories against your own environment.
BeyondTrust has disclosed a critical vulnerability in Remote Support (formerly Bomgar), CVE-2026-102764 (CVSS 9.3), which has been exploited as a zero-day since late August 2026. Internal components of the product do not properly check where the messages they receive come from, so an unauthenticated remote attacker can perform file operations on the appliance. Remote Support versions 26.2.3 and earlier are affected. BeyondTrust attributes the attacks to a suspected China-nexus espionage actor, which Mandiant tracks as ARMORY CASTLE (UNC5221), and Mandiant warns that wider exploitation may follow. BeyondTrust released the BT26-05 patch on 8 October and has already patched its cloud-hosted (SaaS) Remote Support and Privileged Remote Access instances. Self-hosted appliances must be patched by their owners, and BeyondTrust recommends that self-hosted Privileged Remote Access customers apply the patch as a precaution.
What to do:
- Apply the BT26-05 patch to self-hosted Remote Support and Privileged Remote Access appliances now, or enable automatic updates.
- Check for compromise: look for unknown files in web directories, unexpected privileged sessions or permission changes, web service accounts starting shells, and gaps in logs. If you find anything, rotate the credentials stored in or brokered by the appliance.
- Restrict exposure: limit administrative interfaces to trusted networks, restrict outbound traffic from the appliance, and forward its logs to your SIEM.
Source: BeyondTrust security advisory BT26-05
If you would like help assessing your exposure, contact us.
