Security monitoring company Previdian says its sensors recorded two new probing attempts against BeyondTrust Remote Support decoy appliances on November 1, renewing attention on CVE-2026-102764, a critical vulnerability that can let unauthenticated attackers perform file operations on affected systems. The company reported no successful compromise from the two observations.
Previdian’s public report says the attempts came from one source IP and were seen by two sensors. The observations targeted honeypot infrastructure, so they show renewed attacker interest but do not establish that a production appliance was breached or that a broader exploitation campaign is underway.
BeyondTrust disclosed the flaw in advisory BT26-05 on October 15. The vulnerability stems from internal messaging components that fail to validate message origins. It affects Remote Support versions 26.2.3 and earlier and carries a CVSS v4 score of 9.3, rated critical.
BeyondTrust says its Remote Support SaaS customers were patched on October 9. Self-hosted customers should apply the BT26-05-RS patch, available for versions 24.3.1 through 26.2.3. Organizations running older releases must first upgrade to a supported version. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16, following earlier exploitation reports.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
