BeyondTrust has disclosed a critical vulnerability in Remote Support after evidence showed attackers had already been exploiting the flaw before a patch was publicly available.
The vulnerability, CVE-2026-102764, can allow a remote attacker to perform file operations on affected appliances. Cloud-hosted customers were patched by the provider, while organisations running self-hosted deployments were required to confirm remediation themselves.
Remote-support systems are especially sensitive because they are built to reach other machines with elevated privileges. A weakness in that layer can give an attacker leverage far beyond the initial appliance.
For organisations running affected systems, patching is only the first step. Because exploitation happened before disclosure, logs and indicators also need to be reviewed for signs that an attacker may already have used the weakness.
The incident reinforces a broader rule: privileged remote-access tools should be treated as critical infrastructure. They need tight exposure controls, strong administrative separation and a place in incident-response exercises because losing trust in them can complicate recovery across the whole environment.