Critical BeyondTrust Vulnerability Faces Fresh Exploitation Probes as Hackers Prepare for Mass Scanning

Fresh probes targeting CVE-2026-102764 have raised concerns that attacks against BeyondTrust Remote Support could spread beyond targeted espionage.

Previdian reported two probes against decoy appliances in the United States and Europe, both from one source IP address geolocated to Hong Kong.

The company said it had not observed successful exploitation from this activity, leaving wider mass scanning a warning rather than a confirmed finding.

The findings add urgency for organizations running vulnerable, internet-facing appliances. BeyondTrust rates the flaw critical, with a CVSS score of 9.3. It affects Remote Support versions 26.2.3 and earlier unless the required patch has been applied.

According to Previdian’s shared report, the requests targeted POST /api/start_session and included the parameters issue_menu=1&id=1&c2cjs=1&platform=thin. The traffic resembled a BeyondTrust Metasploit module currently under review. However, the company stressed that it was not an exact match.

That resemblance suggests attackers may be testing publicly developed exploit methods against exposed systems. However, the reported sample remains small.

Critical BeyondTrust Vulnerability

Two requests from one source do not establish a widespread campaign, identify the operator, or prove that a working exploit reached production systems. Previdian described the activity as a possible early sign of broader opportunistic attacks.

The underlying vulnerability involves an internal messaging component that failed to check the origin of incoming messages properly.

BeyondTrust says a remote attacker could use the weakness to perform file operations on an affected appliance. Its BT26-05 security advisory documents the affected versions and patch requirements.

Mandiant previously linked successful exploitation in late August 2026 to ARMORY CASTLE, a suspected China-linked espionage group formerly tracked as UNC5221. Those attacks occurred before public disclosure, making them zero-day attacks. Successful exploitation allowed arbitrary file uploads.

Cybersecurity News previously covered the BeyondTrust zero-day exploitation, including deployment of the SAWFLY PHP web shell and escalation to root privileges.

Its related report on Chinese hackers exploiting BeyondTrust detailed attempts to reach stored credentials and systems managed through compromised appliances. These earlier intrusions show why fresh probes deserve attention, even without confirmed success.

Self-hosted customers should apply BT26-05-RS immediately. The patch supports versions 24.3.1 through 26.2.3. Customers running older releases must upgrade first. BeyondTrust says it patched all hosted Remote Support customers by October 9, 2026.

CISA’s October 16 alert confirms active exploitation and records the vulnerability’s addition to its Known Exploited Vulnerabilities catalog that day. The agency advises limiting external access and restricting administrative interfaces to trusted networks.

Pair patching with an investigation. CISA recommends checking for unknown privileged sessions, unexpected scripts, missing logs, and unauthorized account or permission changes.

Organizations that suspect compromise should isolate appliances and preserve forensic evidence. Recovery guidance includes rebuilding from a known-good state, applying the patch, rotating appliance-managed credentials, revoking support sessions, and reviewing new multifactor authentication registrations. These steps address earlier attacker access, not just the exposed vulnerability.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Critical BeyondTrust Vulnerability Faces Fresh Exploitation Probes as Hackers Prepare for Mass Scanning appeared first on Cyber Security News.