CVE-2026-102764 identifies a critical authentication bypass vulnerability within BeyondTrust Remote Support, rated 9.8 CRITICAL. This flaw allows an unauthenticated attacker to bypass security mechani

CVE-2026-102764 identifies a critical authentication bypass vulnerability within BeyondTrust Remote Support, rated 9.8 CRITICAL. This flaw allows an unauthenticated attacker to bypass security mechani

BeyondTrust Remote Support CVE-2026-102764 is exploited and in CISA KEV, with a public exploit module. Apply BT26-05-RS on self-hosted appliances and hunt.

Vulnerabilità PHP, Plex, Siemens, Nextcloud e BeyondTrust sfruttate ITW, nuove campagne malevole di diversa natura, attacchi in Italia

The new controls aim to curb AI agents' machine-speed access to company systems as research shows they can trigger thousands of endpoint actions.

Previdian recorded two new attempts against BeyondTrust Remote Support decoys, renewing attention on a critical flaw that still requires patching on self-hosted systems.

A New Wave of Suspicious Activity Raises Exploitation Concerns Cybersecurity researchers have detected new scanning activity targeting BeyondTrust Remote Support appliances, raising concerns that exploitation of CVE-2026-102764 could be expanding beyond previously targeted intrusions into broader opportunistic attacks. Threat monitoring company Previdian reported two suspicious requests against its decoy systems in the United States and Europe on November 1, 2026. Although neither attempt resulted in confirmed exploitation, the activity suggests that additional threat actors may be investigating the vulnerability.

Una investigación de BeyondTrust evidenció que los agentes de IA pueden generar múltiples acciones a partir de una sola instrucción y conectarse con decenas de servidores. Estos hallazgos plantean el ...

TL;DR Rapid7 has published a full technical analysis and a working Metasploit module for CVE-2026-102764. This BeyondTrust Remote Support vulnerability is already exploited in the wild. The flaw scores 9.3 on CVSS v4. According to Rapid7, it lets "an unauthenticated attacker write files on the appliance and execute code as the site's operating-system user." Attackers abused this zero-day from August 2026, well before BeyondTrust disclosed it on October 15.

Fresh probes targeting CVE-2026-102764 have raised concerns that attacks against BeyondTrust Remote Support could spread beyond targeted espionage. Previdian reported two probes against decoy appliances in the United States and Europe, both from one source IP address geolocated to Hong Kong. The company said it had not observed successful exploitation from this activity, leaving wider mass scanning a warning rather than a confirmed finding. The findings add urgency for organizations running vulnerable, internet-facing appliances. BeyondTrust rates the flaw critical, with a CVSS score of 9.3. It affects Remote Support versions 26.2.3 and earlier unless the required patch has been applied. According to Previdian’s shared report , the requests targeted POST /api/start_session and included the parameters issue_menu=1&id=1&c2cjs=1&platform=thin. The traffic resembled a BeyondTrust Metasploit module currently under review. However, the company stressed that it was not an exact match. That resemblance suggests attackers may be testing publicly developed exploit methods against exposed systems. However, the reported sample remains small. Critical BeyondTrust Vulnerability Two requests from one source do not establish a widespread campaign, identify the operator, or prove that a working exploit reached production systems. Previdian described the activity as a possible early sign of broader opportunistic attacks. The underlying vulnerability involves an internal messaging component that failed to check the origin of incoming messages properly. Two Decoy Appliance Probes From One Hong Kong IP (source: PrevidianCyber ) BeyondTrust says a remote attacker could use the weakness to perform file operations on an affected appliance. Its BT26-05 security advisory documents the affected versions and patch requirements. Mandiant previously linked successful exploitation in late August 2026 to ARMORY CASTLE, a suspected China-linked espionage group formerly tracked as UNC5221 . Those attacks occurred before public disclosure, making them zero-day attacks. Successful exploitation allowed arbitrary file uploads. Cybersecurity News previously covered the BeyondTrust zero-day exploitation , including deployment of the SAWFLY PHP web shell and escalation to root privileges. Its related report on Chinese hackers exploiting BeyondTrust detailed attempts to reach stored credentials and systems managed through compromised appliances. These earlier intrusions show why fresh probes deserve attention, even without confirmed success. Self-hosted customers should apply BT26-05-RS immediately. The patch supports versions 24.3.1 through 26.2.3. Customers running older releases must upgrade first. BeyondTrust says it patched all hosted Remote Support customers by October 9, 2026. CISA’s October 16 alert confirms active exploitation and records the vulnerability’s addition to its Known Exploited Vulnerabilities catalog that day. The agency advises limiting external access and restricting administrative interfaces to trusted networks. Pair patching with an investigation. CISA recommends checking for unknown privileged sessions, unexpected scripts, missing logs, and unauthorized account or permission changes. Organizations that suspect compromise should isolate appliances and preserve forensic evidence. Recovery guidance includes rebuilding from a known-good state, applying the patch, rotating appliance-managed credentials, revoking support sessions, and reviewing new multifactor authentication registrations. These steps address earlier attacker access, not just the exposed vulnerability. Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Critical BeyondTrust Vulnerability Faces Fresh Exploitation Probes as Hackers Prepare for Mass Scanning appeared first on Cyber Security News .

Neue BeyondTrust-Lösung „AI Agent Security“ stoppt unerwünschte Aktivitäten Künstlicher Intelligenz