BeyondTrust patches zero-day exploited in attacks since August

CVE v události 1

Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 9.3.

Tahle CVE jsem vytáhl z širšího textu článku: CVE-2023-46805, CVE-2023-4966, CVE-2024-12356, CVE-2024-12686, CVE-2024-21887, CVE-2025-0282, CVE-2026-1731. Neukazuju u nich proto fakta z katalogů výše, a to preventivně, protože článek se na ně mohl jen odkazovat, třeba jako na starší kauzu.

Jak se o tom psalo 12

1. 18. 10. 2026 · zachyceno 18:30 · NCSC-FI FI

   BeyondTrust Remote Support - BT26-05

   Classification: Critical, Solution: Official Fix, Exploit Maturity: Functional, CVSSv3.1: 9.3, CVEs: CVE-2026-102764, Summary: BeyondTrust has remediated a critical vulnerability in Remote Support (RS) that could allow a remote attacker to perform file operations on an affected appliance. The vulnerability exists within internal components of Remote Support. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could be used to…

2. 16. 10. 2026 18:34 · Cyber Centre Kanada CA

   AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support – CVE-2026-102764

   Number: AL26-025 Date: October 16, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Canadian…

3. 16. 10. 2026 15:30 · CERT-SE SE

   BeyondTrust varnar för kritisk nolldagssårbarhet

   BeyondTrust har publicerat information om en allvarlig nolldagssårbarhet i BeyondTrust Remote Support. Sårbarheten CVE-2026-102764 har fått en CVSS-klassning på 9.3, och kan utnyttjas för att skriva kod till systemet utan autentisering för att på så sätt få kontroll över enheten och sedan ta sig vidare i organisationens system. [1]

4. 16. 10. 2026 15:06 · Cyber Centre Kanada CA

   BeyondTrust security advisory (AV26-1054)

   Serial number: AV26-1054 Date: October 16, 2026 As of October 15, 2026, BeyondTrust is affected by a vulnerability in the following product: Remote Support Prior to or equal to 26.2.3 Open-source reporting indicates that CVE-2026-102764 is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. ARMORY CASTLE and BT26-05: What Security Teams Need to Know | BeyondTrust Security…

5. 16. 10. 2026 15:00 · The Record US

   Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day

   An alleged Chinese state-backed group is using a new zero-day affecting BeyondTrust IT support software to conduct espionage attacks.

6. 16. 10. 2026 · zachyceno 23:30 · CISA Advisories US

   CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support

   CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA added CVE-2026-102764 to its Known Exploited…

7. 16. 10. 2026 10:59 · NCSC-NL NL

   NCSC-2026-0437 [1.00] [H/H] Kwetsbaarheid verholpen in BeyondTrust Remote Support

   BeyondTrust heeft een kritieke kwetsbaarheid verholpen in BeyondTrust Remote Support. De kwetsbaarheid met kenmerk CVE-2026-102764 heeft een CVSS-score van 9.3 en betreft onvoldoende validatie van de herkomst van berichten binnen de interne componenten van het product. Hierdoor kan een niet-geauthenticeerde kwaadwillende de kwetsbaarheid op afstand misbruiken om bestanden op een getroffen appliance te plaatsen of te wijzigen. Alle Remote Support-versies tot en met 26.2.3 zijn getroffen.…

8. 16. 10. 2026 10:51 · CSIRT Itálie (ACN) IT

   BeyondTrust: rilevato sfruttamento in rete della CVE-2026-102764

   BeyondTrust ha rilevato lo sfruttamento in rete di una vulnerabilità con gravità “critica”, identificata tramite la CVE-2026-102764, in Remote Support, soluzione enterprise di assistenza remota.

9. 16. 10. 2026 10:51 · CSIRT Itálie (ACN) IT

   Risolta vulnerabilità in BeyondTrust

   BeyondTrust ha rilasciato aggiornamenti di sicurezza per risolvere una vulnerabilità con gravità “critica” in Remote Support, soluzione enterprise di assistenza remota. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un attaccante, in determinate condizioni e mediante l'impersonificazione di entità legittime attraverso l'elusione dei meccanismi di validazione dell'origine dei messaggi, di effettuare operazioni non autorizzate sui file dell'appliance interessata.

10. 16. 10. 2026 08:18 · BleepingComputer US nadpis události

    BeyondTrust patches zero-day exploited in attacks since August

    BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]

11. 16. 10. 2026 · zachyceno 20:00 · CISA KEV US

    BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (CVE-2026-102764)

    CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities catalog. Affected product: BeyondTrust Remote Support. Remediation due date: 2026-10-19.

12. 15. 10. 2026 16:00 · Mandiant / Google TI US

    ARMORY CASTLE Exploits BeyondTrust

    Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints. The successful exploitation of this vulnerability results in the arbitrary…