Skip to content
CHRONOSAlerts
Cybersecurity & InfrastructureUrgency level L3ElevatedActive
CHRONOS Cybersecurity & Infrastructure category illustration. Illustrative only, not specific to this event.
CHRONOS VisualizationCybersecurity & Infrastructure illustration, not specific to this event

BeyondTrust discloses exploited critical Remote Support vulnerability

Event summary

BeyondTrust and Google/Mandiant disclosed CVE-2026-102764 on October 15, with confirmed earlier exploitation. Vendor patches are available; SaaS deployments were patched by October 9 and unpatched self-hosted customers need to update.

CHRONOS Wire · October 16 · Alert 4

0:48
Publication details
Published
Updated
Revision
r497811
Source
BeyondTrust
Urgency
3/5
Elevated
85/100
VERY HIGH
87/100
VERY HIGH
66/100
NOTABLE
82/100
HIGH
97/100
VERY HIGH

Cliff Notes

  • Confirmed exploited critical Remote Support flaw; vendor patch available. SaaS already patched; self-hosted customers should verify updates.

U.S. Impact

Current impact

Low

U.S. organizations operating affected installations may need immediate remediation; no nationwide outage confirmed.

Potential impact

Severe

U.S. organizations operating affected installations may need immediate remediation; no nationwide outage confirmed.

Impact type
Direct
Time horizon
Immediate to medium term
Confidence
High
Key channels
Investment exposure · Business continuity
Assessment reasoning

U.S. organizations operating affected installations may need immediate remediation; no nationwide outage confirmed.

U.S. Impact is an analytical assessment of the estimated current and potential effects on the United States. It is not a probability forecast.

On October 15, BeyondTrust and Google/Mandiant disclosed a critical Remote Support vulnerability, CVE-2026-102764, rated 9.3 under CVSS v4. Mandiant confirmed prior exploitation in August. BeyondTrust said Remote Support SaaS customers were patched by October 9, while self-hosted customers without automatic updates should apply the patch. Broader exploitation after disclosure is possible but not established.

ELI5: Plain-English Explanation

A security flaw in a remote IT-support product was used in a real attack. The vendor released a fix. Organizations operating their own installations must ensure they have applied it.

Why Urgent Level 3

Level 3: confirmed exploitation and critical severity affecting a cross-sector IT product; broad new exploitation has not been confirmed.

What Changed

Coordinated public disclosure of a critical vulnerability and confirmed earlier exploitation.

What Is Genuinely New

A newly identified CVE, vendor remediation guidance and corroborated incident investigation.

CHRONOS Bottom Line

Patch and verify affected installations; do not assume every customer was compromised.

Market Reality Gap

Confirmed earlier incident and patch; no confirmed widespread economic impact.

Resilience / Shock Absorbers

Vendor patch shipped before public disclosure; SaaS deployments were updated.

Watch Windows

24h
7d
30d
90d

Uncertainties / Known Unknowns

Unpatched customer count and future exploitation breadth.

Detailed Analysis

Confirmed exploited enterprise software vulnerability, with available mitigation and uncertain wider exposure.

Affected Countries

  • United States

Affected Industries

  • Cybersecurity
  • Enterprise IT
  • Managed services

Affected Companies

  • BeyondTrust
  • Google
  • Mandiant

Affected Assets

  • BeyondTrust Remote Support installations
  • Enterprise IT services

Sources / Evidence

  1. 01
    BT26-05 advisory
    BeyondTrust2026-10-15
  2. 02
    ARMORY CASTLE Exploits BeyondTrust
    Google/Mandiant2026-10-15
  3. 03
    Google warning
    Reuters2026-10-15

Follow CHRONOS ALERTS

Published alerts also appear on Instagram and Threads as @chronosalerts.

Instagram@chronosalertsThreads@chronosalerts