A serious flaw in BeyondTrust Remote Support, a tool many IT providers and businesses use to connect to computers remotely, is being actively attacked. Attackers can break in without a password.

• What it is: An authentication bypass (CVE-2026-102764) that lets an outsider upload files to the system and potentially take over the whole appliance.
• Who is affected: Businesses running their own (self-hosted) Remote Support server, version 26.2.3 or earlier. BeyondTrust has already patched its cloud-hosted (SaaS) service, so those customers need to do nothing.
• The risk: Attacks have reportedly been under way since late August. A compromised server can give attackers a foothold to reach other systems on your network.
• What to do: Apply the BT26-05-RS patch now. Servers older than version 24.3.1 must be upgraded first. If your server was reachable from the internet while unpatched, have it reviewed for signs of compromise before trusting it again.

We recommend that any business using self-hosted BeyondTrust patches today. If you are unsure which version you run, contact OzComm and we will check for you.

Sources: Canadian Centre for Cyber Security alert AL26-025; BleepingComputer.