Swiss SME Cyber Alert: BeyondTrust Remote Support – zero-day is being actively exploited
BeyondTrust Remote Support, formerly known as Bomgar, is used by IT teams and service providers to maintain systems remotely.
A critical zero-day vulnerability has already been exploited against self-hosted appliances. BeyondTrust patched its SaaS instances by 9 October 2026, but self-hosted systems require an explicit check.
If your company or IT provider operates BeyondTrust Remote Support on its own appliance, ask them now to confirm that BT26-05-RS is installed and whether the system has been internet-accessible since late August 2026.
What happened?
On 15 October 2026, BeyondTrust disclosed CVE-2026-102764 in Remote Support. An unauthenticated remote attacker can perform file operations on a vulnerable appliance.
BeyondTrust and Mandiant confirm that a suspected state-backed actor exploited the flaw as a zero-day on 29 August 2026 against one hosted and one self-hosted Remote Support instance. Post-exploitation activity included administrative control, persistence, access to stored or brokered credentials and remote access to downstream systems.
Could my business be affected?
All self-hosted BeyondTrust Remote Support appliances running versions up to and including 26.2.3 are affected. The product may be operated directly by your business or by an external IT provider.
Remote Support SaaS: BeyondTrust patched all SaaS instances by 9 October 2026; no further customer action is required for the appliance itself.
Self-hosted 24.3.1 through 26.2.3: Install BT26-05-RS or confirm that automatic updating applied it.
Self-hosted versions older than 24.3.1: Upgrade to a supported version, then apply BT26-05-RS.
BeyondTrust Privileged Remote Access shares affected code. BeyondTrust has not confirmed exploitability in PRA, but recommends the patch for self-hosted systems as a precaution.
What should you do now?
Ask your IT provider today to perform a short inventory and patch check. The first question is whether BeyondTrust Remote Support or Bomgar is used as SaaS or on a self-hosted appliance.
For self-hosted appliances, document the installed version and BT26-05-RS patch status.
Check whether the appliance was reachable from the internet on a vulnerable version at any time since 29 August 2026.
If it was exposed, preserve off-appliance syslog, firewall, reverse-proxy and WAF records and perform a compromise assessment.
If there are signs of compromise, coordinate containment with BeyondTrust Support or an incident-response specialist; rotate credentials only after patching or rebuilding the appliance.
How urgent is it?
Urgency: very high for self-hosted Remote Support appliances exposed to the internet.
This is confirmed zero-day exploitation requiring no authentication. SaaS customers are already patched at the appliance level; self-hosted deployments need an active check because automatic-update coverage varies and applying the patch does not undo an earlier compromise.
Information for your IT provider
CVE: CVE-2026-102764; CVSS v4.0: 9.3; CWE-290.
Affected: BeyondTrust Remote Support up to and including 26.2.3.
Fix: BT26-05-RS for versions 24.3.1 through 26.2.3; upgrade older versions first.
Attack path: network, low complexity, no privileges and no user interaction required.
Impact: file operations or arbitrary file upload on the appliance; Mandiant states this can lead to host-level control and access to credentials stored or brokered by the appliance.
For potentially exposed systems, review Mandiant's indicators and detection guidance. Off-appliance logs are especially important because the actor deleted local logs.
