BeyondTrust
US maker of privileged access and remote support software.
BeyondTrust disclosed on 15 October that attackers had exploited a 9.3-rated flaw in its Remote Support tool since 29 August, while self-hosted operators learnt about it after cloud customers were patched.
Last refreshed: 22 October 2026 · Appears in 1 active topic
Why did self-hosted customers learn of the flaw after cloud systems were patched?
Timeline for BeyondTrust
Published its advisory six days after fixing cloud customers
Cybersecurity: Threats and Defences: BeyondTrust tool hit before its advisoryBackground
BeyondTrust is a US maker of privileged-access and remote-support software. Its products help organisations control powerful accounts and let support staff connect to other systems. Those functions place the company's software on access paths that attackers can use if a product's authentication fails.
On 15 October 2026, BeyondTrust disclosed a 9.3-rated flaw in its Remote Support help-desk tool. Attackers had exploited it from 29 August. Mandiant linked the activity to ARMORY CASTLE, a suspected China-linked espionage group. BeyondTrust had patched cloud customers by 9 October. Operators running the product on their own systems learnt of the flaw through the public advisory six days later.
The incident shows how BeyondTrust's delivery model can change the timing of protection. The vendor could patch its hosted service directly, while self-hosted customers needed both notice and an update they could apply themselves.
BeyondTrust staggered its disclosure
On 15 October, BeyondTrust disclosed a vulnerability rated 9.3 in its Remote Support help-desk tool. Attackers had exploited the flaw since 29 August. Google's Mandiant tied the activity to ARMORY CASTLE, which it suspects is linked to Chinese espionage.
BeyondTrust had patched customers using its cloud service by 9 October. Operators running the product on their own systems learnt of the flaw six days later, through the public advisory. The episode matters from BeyondTrust's vantage because both customer groups depended on the same vendor knowledge, but the self-hosted group received the warning after the cloud deployment had already been fixed.
What does BeyondTrust do?
When did BeyondTrust patch CVE-2026-102764?
How many BeyondTrust customers were hit by the zero-day?
Who attacked BeyondTrust Remote Support?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.