BeyondTrust Remote Support Faces Fresh Probes for Critical Flaw
Original title: Critical BeyondTrust Vulnerability Faces Fresh Exploitation Probes as Hackers Prepare for Mass Scanning
Probes target BeyondTrust Remote Support versions 26.2.3 and earlier; CISA added to KEV with active exploitation.
Previdian reported two probes against decoy BeyondTrust Remote Support appliances from a Hong Kong IP. The company observed no successful exploitation but noted the traffic matched a Metasploit module under review. CISA confirmed active exploitation of CVE-2026-102764 and added it to its KEV catalog. The critical flaw allows arbitrary file operations on affected appliances.
Unconfirmed: Fresh probes may signal opportunistic attacks but successful exploitation in this activity is unconfirmed.
- Probes target POST /api/start_session with parameters issue_menu=1&id=1&c2cjs=1&platform=thin
- CVSS score 9.3; affects versions 26.2.3 and earlier
- BT26-05 patch available for versions 24.3.1 through 26.2.3
- CISA added to KEV on October 16, 2026
- Prior exploitation linked to ARMORY CASTLE before public disclosure
Impact: arbitrary file operations on internet-facing appliances
| Product | Affected | Fixed in |
|---|---|---|
| BeyondTrust Remote Support | 26.2.3 and earlier | BT26-05 patch |
- 1.Apply BT26-05 patch
- 2.Limit external access to appliances
- 3.Investigate for unauthorized privileged sessions
- CVEs
- CVE-2026-102764
- Vendors
- BeyondTrust
- Products
- Remote Support
- Threat actors
- ARMORY CASTLE
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102764 | Message-origin spoofing enables file ops on BeyondTrust Remote Support | 9.3 | 19% | KEVPoC ×2 | KEV |
From the original article
2 min read at cybersecuritynews.com
Fresh probes targeting CVE-2026-102764 have raised concerns that attacks against BeyondTrust Remote Support could spread beyond targeted espionage. Previdian reported two probes against decoy appliances in the United States and Europe, both from one source IP address geolocated to Hong Kong. The company said it had not observed successful exploitation from this activity, leaving wider […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.