Cyber

What changed

A serious vulnerability, identified as CVE-2026-102764, has been discovered in BeyondTrust Remote Support, previously known as Bomgar. This flaw, which has a CVSS score of 9.3, involves improper origin validation within an internal messaging component, allowing unauthorized access to remote support servers.

The exploitation of this zero-day vulnerability was reported to have occurred in late August 2026, with the cyber espionage group Armory Castle, also known as UNC5221 or Warp Panda, actively leveraging it for unauthorized access.

Who is affected

Organizations utilizing BeyondTrust Remote Support are at risk due to this vulnerability. The potential impact includes unauthorized access to sensitive systems and data.

This vulnerability could affect a wide range of sectors, particularly those relying on remote support solutions for operational continuity.

• BeyondTrust Remote Support users
• Organizations in sectors such as IT, finance, and healthcare
• Companies with remote workforce solutions
• Any entity utilizing remote access tools for support services

What to do

Immediate action is recommended for organizations using BeyondTrust Remote Support. Security teams should assess their systems for the presence of this vulnerability and apply any available patches or mitigations.

Additionally, monitoring for unusual activity on remote support servers is crucial to detect any potential exploitation attempts.

• Review and apply patches from BeyondTrust as soon as they are available.
• Implement network segmentation to limit exposure of remote support servers.
• Enhance monitoring and logging of access to remote support systems.
• Educate staff on recognizing suspicious activity related to remote access.

What changed

BeyondTrust has addressed a critical security flaw in its Remote Support software, which has been under active exploitation since late August. The company has urged all users to implement the patch immediately to mitigate potential risks.

• The vulnerability is classified as a zero-day, indicating it was exploited before a fix was available.
• Users of the affected software are at risk of unauthorized access and potential data breaches.
• The patch is now available for immediate deployment to secure systems.

Who is affected

Organizations utilizing BeyondTrust Remote Support are directly impacted by this vulnerability. It is crucial for these entities to prioritize patching to safeguard their systems.

• BeyondTrust Remote Support users across various sectors.
• IT departments managing remote support solutions.
• Organizations with sensitive data that rely on remote access tools.
• Any third-party vendors integrating BeyondTrust solutions.

What to do

Immediate action is required to patch the vulnerability in BeyondTrust Remote Support. Organizations should ensure that their systems are updated to the latest version as soon as possible.

• Review and apply the latest security patches provided by BeyondTrust.
• Monitor systems for any unusual activity that may indicate exploitation.
• Educate staff on the importance of timely updates and security practices.
• Consider conducting a security audit to assess the overall risk posture.