BeyondTrust vulnerability (CVE-2026-102764): attackers had a 47-day head start
On October 15, BeyondTrust disclosed a critical flaw in Remote Support (formerly Bomgar), a remote control tool used by many help desks and IT providers. The BeyondTrust vulnerability, CVE-2026-102764 (CVSS 9.3), lets an attacker drop files on the server with no password and no click. A China-linked espionage group had been exploiting it since August 29: a 47-day head start on everyone else.
Your SMB may never have heard of BeyondTrust. But if your IT provider or a software vendor connects to your computers with this tool, a key to your business was exposed. Here’s who is affected, the calendar, what the attackers did once inside and the order in which to change passwords.
BeyondTrust vulnerability: who needs to act, based on your setup
Where does your Remote Support run? Read the column that matches you
Sources: BeyondTrust advisory BT26-05 and Canadian Centre for Cyber Security alert AL26-025.
The calendar: a 47-day head start for attackers
From first hack to disclosure (dates from BeyondTrust, Mandiant and CISA)
- Aug. 29: the group exploits the still-unknown flaw against one BeyondTrust cloud instance and one customer-hosted server.
- Sept. 27: another attack on a security device maker goes public; BeyondTrust starts a threat hunt. Sept. 30: Mandiant confirms its findings at the affected customer.
- Sept. 28: the hunt finds the compromised instance, contained 27 minutes after detection.
- Oct. 8: patch released; Oct. 9: every cloud instance is patched.
- Oct. 15: public disclosure (BT26-05 advisory and Mandiant analysis). Oct. 16: CISA adds the flaw to its catalog of exploited vulnerabilities; the Canadian Centre for Cyber Security issues alert AL26-025.
- Oct. 19: CISA’s deadline for U.S. federal agencies.
According to BeyondTrust, only two customers were affected as of October 16, and no activity from the group has been seen since August. The risk changes now that the flaw is public: Mandiant points out that this group, which it calls ARMORY CASTLE (formerly UNC5221), usually moves to mass exploitation of every unpatched server as soon as a flaw is known. It did so in 2024 with Ivanti flaws.
Patching doesn’t mean cleaning
Here’s what Mandiant found below the surface on one customer’s server. The patch closes the front door; it removes nothing that was installed before.
🔔 The most useful lesson: the alarm did go off
BeyondTrust says its sensors did react when the attacker gained root rights. But the automated triage tool in its detection platform labelled those alerts as false positives and closed them. The company now requires that no automated triage can close a serious alert on its own. For an SMB, that’s the case for proactive monitoring of your systems: the machine sorts, but a serious alert wakes up a person who checks.
Change passwords, in the right order
A remote support server stores the passwords technicians need for your computers and servers. Mandiant recommends changing them only after the server is patched or rebuilt (otherwise the attacker sees the new ones), in this order:
Rotation order recommended by Mandiant
Appliance administration accounts (/appliance)
The door to the engine room.
Console administrators and users (/login)
The people who open support sessions.
API account secrets
The integrations that drive the console.
Directory bind accounts and SAML signing keys
The link to Microsoft Entra or Active Directory.
Vault passwords
Changed on each target system, not just in the vault.
Integration credentials
Email (SMTP), logs (syslog), ticketing tool, outbound events.
Any password typed during a support session
Since late August, if in any doubt.
Then add the BeyondTrust and CISA checks: end every active session, redeploy the clients installed on computers, review new multi-factor authentication registrations on privileged accounts, and look for any permission change without a ticket or a named owner.
Your SMB doesn’t host anything? Three questions for your IT provider
The BeyondTrust vulnerability mostly reaches you indirectly, through your provider. Ask them these questions this week:
- Do you use BeyondTrust Remote Support or Bomgar to connect to us, cloud or self-hosted?
- If self-hosted: is the BT26-05-RS patch installed, since when, and have you checked for signs of intrusion since August 29?
- Which of our company’s passwords did that server store, and have they been changed since?
Use the opportunity to list every tool that can take control of your computers, as our decision tree on abused remote access tools suggests. A forgotten tool is a door nobody watches.
What about Quebec’s Law 25?
If support sessions reached computers holding personal information (client files, HR, payroll), you must assess the risk of serious injury and record the incident in your register of confidentiality incidents, even if the door was opened at your provider.
To go further: our proactive monitoring of your systems, our IT support and help desk, our cybersecurity services, and two recent cases of hijacked vendor access: ConnectWise Cloud Backup (SkyKick) and the Ivanti Connect Secure vulnerability.
Book your free cyber check
Not sure which remote access tools can get into your systems, or who watches them? The free cyber check inventories that access, reviews your administrator accounts and logs, and gives you a clear list of fixes.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- BeyondTrust, security advisory BT26-05 (CVE-2026-102764), October 15, 2026
- BeyondTrust, “ARMORY CASTLE and BT26-05: What Security Teams Need to Know”, updated October 16, 2026
- Mandiant / Google Threat Intelligence Group, “ARMORY CASTLE Exploits BeyondTrust”, October 15, 2026
- CISA, “CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support”, October 16, 2026
- Canadian Centre for Cyber Security, alert AL26-025, October 16, 2026
Photo: MART PRODUCTION, Pexels (Pexels licence).