Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
BeyondTrust Remote Support
AI-generated illustration
ProductUS

BeyondTrust Remote Support

BeyondTrust Remote Support software that lets help desks control users' computers.

BeyondTrust disclosed on 15 October 2026 that attackers had exploited a critical Remote Support flaw since 29 August, before self-hosted customers received the public warning.

Last refreshed: 22 October 2026 · Appears in 1 active topic

Key Question

Which self-hosted Remote Support systems were exposed before the public warning?

Timeline for BeyondTrust Remote Support

#15 15 Oct

BeyondTrust tool hit before its advisory

Cybersecurity: Threats and Defences
View full timeline →
Follow Cybersecurity: Threats and Defences →

Background

BeyondTrust Remote Support is enterprise software that lets IT support Teams access and troubleshoot users' computers from another location. It was formerly known as Bomgar. Organisations can use BeyondTrust's cloud service or run the product on their own appliances.

The product's remote-control role gives it privileged access to customer systems. A compromise of its appliance can therefore give an attacker a route into machines that support staff manage. Cloud and self-hosted deployments receive fixes through different operational paths, so customers must know which model they run and maintain it accordingly. Help desks use those channels to manage support sessions across customer networks.

Key Issues
Zero day exploitation

Remote Support flaw preceded its warning

BeyondTrust disclosed on 15 October 2026 that CVE-2026-102764 had been exploited from 29 August. The critical flaw affects Remote Support 26.2.3 and earlier. It lets an unauthenticated remote attacker perform file operations that can lead to control of an appliance.

Google's Mandiant attributed the observed activity to ARMORY CASTLE, which it suspects is a China-linked espionage group. Investigators said the actor escalated privileges, installed a web Shell and tunnelling tool, and deleted logs. BeyondTrust had patched its cloud service by 9 October. Supported self-hosted systems needed the BT26-05-RS patch, while older versions first required an upgrade.

Common Questions
What is BeyondTrust Remote Support?
It is enterprise software that lets authorised IT Teams securely access and troubleshoot remote computers and other endpoints.Source: Mandiant
What is CVE-2026-102764?
It is a critical authentication bypass in BeyondTrust Remote Support that allows unauthenticated file operations and can lead to full appliance compromise.Source: BeyondTrust
What versions of BeyondTrust Remote Support are vulnerable?
BeyondTrust lists Remote Support 26.2.3 and earlier as affected. Supported self-hosted versions require the BT26-05-RS patch.Source: BeyondTrust
How was BeyondTrust Remote Support exploited?
Mandiant says ARMORY CASTLE used the authentication bypass to upload files, escalate privileges, establish persistence and reach credentials stored or brokered by the appliance.Source: Mandiant
When did BeyondTrust Remote Support cloud customers get patched?
BeyondTrust says it applied the fix to all Remote Support cloud customers by 9 October 2026.Source: BeyondTrust
Source Material
AL26-025: Critical vulnerability impacting BeyondTrust Remote SupportARMORY CASTLE Exploits BeyondTrustSecurity Advisory BT26-05

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.