On 15 October BeyondTrust published advisory BT26-05 for CVE-2026-102764, a flaw in Remote Support that under the right conditions allows file operations on the appliance. According to the company it was used on 29 August against two customers, and the vendor warns that after disclosure the group typically moves to broad exploitation of every unpatched instance.
- 15 October 2026: BeyondTrust released advisory BT26-05 and CVE-2026-102764 (CVSS-B 9.3, critical) in Remote Support. Per the NVD description, the components did not adequately validate where messages came from, and under the right conditions an attacker could perform file operations on the appliance.
- According to BeyondTrust the zero-day was used on 29 August against one instance hosted by the company and one self-hosted appliance. The fix is from 8 October, and cloud instances were patched automatically. The company knows of only those two customers.
- BeyondTrust assesses with moderate to high confidence that this is a China-nexus group that Google and Mandiant track as UNC5221. CISA added the flaw to KEV on 16 October with a deadline of 19 October.
The attacker got in on 29 August. The fix came 40 days later, on 8 October. The disclosure, seven days after that.
That is how BeyondTrust itself lays it out. On 29 August the group used a zero-day against one Remote Support instance hosted by the company and one self-hosted appliance. The traces were found on 28 September in a threat hunt, and the cloud instance was contained within 27 minutes of first detection.
The group saves a zero-day for chosen targets. Once the flaw is public, according to BeyondTrust, it typically moves to broad exploitation of every unpatched instance. Mandiant, again by BeyondTrust's account, warns defenders to expect the same here.
BeyondTrust also admits an uncomfortable detail about its own defenses. By its account the sensors fired when the attacker escalated privileges, but the automated triage in a third-party vendor's platform closed the alerts as false positives. Anyone who has worked a door knows why there's a filter in front of the alarm: otherwise it rings for everything. Here the filter threw out the real one.
Mandiant published its own analysis the same day. I don't retell it here, because I haven't opened it. Who the two customers are and how exactly the attack works, BeyondTrust doesn't say either.
BT26-05 is the first job today for anyone running Remote Support or Privileged Remote Access on their own server; cloud instances are already patched. Then the logs. Send them off the appliance, because according to BeyondTrust the group deletes the local ones and the copy off the box is often the only one left.