Your Vendor’s Remote-Support Tool Just Had a Critical Flaw — Here’s What to Check

BeyondTrust disclosed CVE-2026-102764 on 15 October 2026 in its own advisory, BT26-05: a critical authentication-bypass flaw, CVSS 9.3, in its Remote Support platform, caused by the software not properly checking where internal messages come from. According to security researchers tracking the case, as reported by ThreatAFT, the flaw was already being exploited as a zero-day from 29 August 2026, by a suspected China-nexus group that Google’s Mandiant links to the actor it tracks as UNC5221. The vulnerability has been added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue, and Ireland’s NCSC followed with its own advisory on 20 October, five days after public disclosure.

Why this matters even if you’ve never heard of BeyondTrust

Remote Support is the kind of software an IT helpdesk, outsourced support desk, or software vendor uses to reach directly into a client’s machines for troubleshooting. If you’ve ever approved a vendor’s remote-access request, or your current IT provider uses a tool like this to support you, the exposure sits with whoever holds that access — not with you directly, until it does. Researchers report the attackers used their foothold to deploy a webshell and a tunnelling tool, move laterally, and delete appliance logs to cover their tracks, and some of these footholds can survive a simple patch-and-reboot. Only two BeyondTrust customers have been publicly confirmed as affected so far, but Mandiant has warned that wider exploitation is likely now the flaw is public. BeyondTrust’s SaaS customers were patched automatically on 8 October; self-hosted versions from 24.3.1 to 26.2.3 need the BT26-05-RS patch applied directly, and older self-hosted installs must be upgraded before the patch can even be applied.

Why this sits squarely inside NIS2 and GDPR

This is exactly the kind of risk NIS2 asks in-scope organisations to manage under their supply-chain security obligations: not just your own systems, but the security practices of the suppliers and service providers who touch them. Under GDPR, a vendor’s security incident does not shift your responsibility. If personal data you control is exposed through a supplier, you remain the controller, and the usual 72-hour clock to notify the Data Protection Commission still applies where a breach is likely to put people’s rights at risk. Vendor and supply-chain risk is part of what we cover in our IT compliance & NIS2 readiness work. This is general information, not legal advice.

Three checks for this week

1. Ask your current IT provider, or any vendor with standing remote access, which remote-support tool they use — and if it is BeyondTrust Remote Support, whether it has been patched and checked for signs of compromise, not just patched.
2. List every third party that holds persistent remote access to your network, tenant, or endpoints. Vendors accumulate this access over years, and it is rarely reviewed once granted.
3. Confirm that each access grant is scoped to what is actually needed, time-limited where possible, and logged somewhere you can see.

If you would rather have this reviewed and kept current, rather than checked once and forgotten, it is part of our cybersecurity & network security work.

Facts current as of 20 October 2026, drawn from BeyondTrust’s own advisory (BT26-05), the NCSC-IE advisory of 20 October 2026, and third-party security reporting linked above; we have not independently verified attacker attribution.