1.0 Introduction
Recently, BeyondTrust has released a security update to address a critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support.
2.0 Impact
Successful exploitation may allow a remote attacker to trigger security restriction bypass, data manipulation and spoofing on the targeted system. The flaw exists in internal components of Remote Support that did not adequately validate the origin of the messages they received, which could allow an attacker to perform file operations on the appliance. BeyondTrust reports the flaw was exploited as a zero-day from 29 August 2026. Google attributes the activity to a China-linked group it tracks as ARMORY CASTLE, which tried to harvest credentials from the appliance’s secrets database and change Remote Support permissions to reach downstream systems. Compromise of the appliance may therefore lead to access to other systems it manages.
3.0 Affected Products
- BeyondTrust Remote Support version 26.2.3 and prior
4.0 Recommendations
CyberSecurity Malaysia encourages users and administrators to review the following BeyondTrust security advisory and apply the necessary updates. Self-hosted customers should manually apply the BT26-05-RS patch if automatic updates are not enabled in the /appliance interface. Installations older than version 24.3.1 must first upgrade to a newer supported version before applying the patch. BeyondTrust also recommends a precautionary patch for self-hosted Privileged Remote Access appliances because they share the affected code. Installing the patch closes the vulnerability but does not undo activity that may already have occurred, so organisations should determine whether the appliance was compromised before patching.
Kindly refer to the following URL:
- https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999 Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
- https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support