BeyondTrust Remote Support zero-day exploited since August
BeyondTrust is urging customers to patch a critical authentication bypass flaw in its Remote Support (RS) product. A suspected China-nexus espionage group has been exploiting the flaw as a zero-day since late August.
The vulnerability is tracked as CVE-2026-102764. It allows unprivileged remote attackers to perform file operations on unpatched appliances and affects RS 26.2.3 and earlier. The company issued the warning on Thursday.
Remote Support is BeyondTrust's enterprise tool for IT service desks, help desks and customer support teams, who use it to troubleshoot problems on remote machines.
SaaS fixed, self-hosted needs action
BeyondTrust fixed the issue for all Remote Support and Privileged Remote Access SaaS customers on October 8. Organizations running self-hosted installations must apply the patch manually if they have not enabled automatic updates.