Skip to main content
News

BeyondTrust Remote Support Zero-Day Exploited; CISA Flags It Alongside a Fortinet Flaw

On 15 October 2026, BeyondTrust disclosed CVE-2026-102764, a critical Remote Support flaw that attackers had used since late August. A day later CISA added it and Fortinet CVE-2025-61624 to its list of exploited vulnerabilities. What companies running remote support tools or firewalls should do now.

18 Oct 20265 minBeyondTrust Security Advisory BT26-05
BeyondTrustFortinetRemote AccessZero-DayCybersecurityPatch Management

Say your company pays an outside IT provider to look after staff laptops. Every time someone reports a problem, a technician connects through the same remote support tool. That tool also keeps the passwords for servers and key systems, so technicians do not have to type them.

If an attacker gets into that tool, they do not see one machine. They see who connects to what, and they can take the stored passwords with them. That is what just happened with BeyondTrust Remote Support.

What happened

On 15 October 2026, BeyondTrust published security advisory BT26-05 for CVE-2026-102764 in Remote Support (formerly Bomgar). The advisory states:

  • The CVSS 4.0 score is 9.3, rated Critical.
  • Internal messaging components did not check where incoming messages came from, which let a remote attacker perform file operations on the appliance.
  • All versions up to 26.2.3 are affected. The fix is patch BT26-05-RS for versions 24.3.1 to 26.2.3. Anyone older than 24.3.1 has to upgrade before the patch can be applied.
  • SaaS customers were patched by 9 October. Self-hosted customers must apply the patch themselves unless they subscribe to automatic updates.

BeyondTrust's blog gives the timeline. The attacker used the flaw on 29 August 2026 against two customers: one instance hosted by BeyondTrust and one self-hosted appliance. BeyondTrust found the activity on 28 September, shipped the patch on 8 October and disclosed it publicly on 15 October. As of the blog's last update, BeyondTrust knew of only those two affected customers.

BeyondTrust attributes the activity to a suspected China-nexus espionage group that Google Threat Intelligence Group and Mandiant tracked as UNC5221 and now call ARMORY CASTLE. The group prefers edge devices and remote access appliances, and has used zero-days in Citrix NetScaler and Ivanti Connect Secure before.

Mandiant's report from 16 October describes what the attacker did once inside: planted a web shell, escalated to root, dumped the stored credentials, deleted several sets of logs, then used a hijacked admin account to raise some users from No Access to Administrator and open remote sessions to their desktops.

On 16 October, CISA, the US cybersecurity agency, added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog together with Fortinet CVE-2025-61624. US federal agencies must deal with both by 19 October 2026, and CISA marks both as requiring forensic triage, not just patching.

The Fortinet flaw that came with it

CVE-2025-61624 is a path traversal flaw in the command line of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. According to Fortinet advisory FG-IR-26-122, someone who already has a read-write admin account can use existing commands to write or delete any file on the device.

Fortinet scores it 6.0, Medium, because an admin login is needed first. The advisory still lists it as known exploited. Fixed releases are FortiOS 7.6.5 or later and 7.4.10 or later. FortiOS 7.2, 7.0 and 6.4 need to move to a fixed release.

Why it matters for Thai businesses

Remote support tools and firewalls have one thing in common: they hold the keys to other systems. When one of them falls, the attacker does not need to break in machine by machine. Many companies do not run their remote support tool themselves. An outside IT provider set it up, and the owner may not know which product is in use.

Two lessons from this case are worth passing to your team.

First, BeyondTrust says plainly that its own sensors fired the moment the attacker escalated privileges, but the automated triage in its third-party detection platform closed those alerts as false positives. If you rely on an outsourced SOC or an AI-assisted alert filter, ask whether anyone reviews high-severity alerts that were closed automatically.

Second, BeyondTrust notes that once a flaw is public, this group tends to move from a few chosen targets to every unpatched instance it can find. The days after 15 October are the riskiest for anything still unpatched. The Medium-rated Fortinet flaw is a reminder that a CVSS score alone is a poor way to rank work; whether a flaw is being exploited matters more.

Checklist for this week

  1. Ask your IT team and outside providers exactly which BeyondTrust Remote Support, Privileged Remote Access or Fortinet products you run, with version numbers.
  2. If you self-host Remote Support, apply BT26-05-RS now. If you self-host Privileged Remote Access, BeyondTrust found no way to exploit it but released a patch because the code is shared. Apply that too.
  3. If the appliance was reachable from the internet between late August and the day you patched, assume it may be compromised. Check logs that were forwarded off the box, since logs on the appliance may have been deleted or altered, and look for accounts raised to admin without a reason.
  4. Rotate the passwords stored in the remote support tool, but only after patching or rebuilding. Rotating first lets an attacker who is still inside see the new ones.
  5. Limit the admin pages of remote support tools and firewalls to trusted networks, and require phishing-resistant MFA on admin accounts.
  6. For Fortinet, upgrade to a fixed release listed in FG-IR-26-122 and review how many read-write admin accounts exist and who still needs one.

If your team struggles to decide which flaws come first, our article on risk-based patch prioritization explains why exploited flaws go to the top of the list.

What Enersys does

We have built and supported business software for 14 years, covering ERP, AI and personal data work under PDPA. If you want to know which remote tools and admin accounts your business systems or ERP depend on, and how to rotate those credentials without stopping work, talk to the Enersys team.

Sources

Back to Insights

Related Articles

AI That Writes Code Needs Boundaries: GitHub Adds a Sandbox for Coding Agents, and Google Stops Selling Gemini Code Assist

In the first week of October 2026, GitHub let organisations limit what AI coding agents can reach on developer machines and control spending on AI code review, while Google stopped selling Gemini Code Assist Standard and Enterprise. What businesses with in-house or outsourced developers should ask.

AIS x Thai SME Council Launches ProStart — Digital + AI Bundle with 200% Tax Deduction Thai SMEs Shouldn’t Miss

AIS has partnered with the Thai SME Council to launch ProStart, an AI + Digital package for SMEs with a 200% tax deduction worth up to ฿300,000 — a golden opportunity available only until the end of 2027.

Anthropic Hits $30B ARR — Enterprise AI Has Officially Crossed the Tipping Point

Anthropic tripled from $9B to $30B run rate in just four months, with 1,000+ enterprise customers each spending over $1M a year. This is no longer hype — it is proof that Enterprise AI has real ROI at scale, and Thai businesses need to decide when (not if) to move.

"Empowering Innovation,
Transforming Futures."

Contact us to make your project a reality.