BeyondTrust Remote Support: an exploited flaw and a Cyber Centre alert

On October 16, 2026, the Canadian Centre for Cyber Security warned that a critical flaw in BeyondTrust Remote Support, CVE-2026-102764, is being exploited. Attackers have used it since late August to take over self-hosted appliances. If your organization or IT provider runs Remote Support on its own servers, apply BeyondTrust’s BT26-05 patch and check for compromise.

What happened

BeyondTrust published security advisory BT26-05 on October 15, 2026. It describes CVE-2026-102764, a flaw in how internal Remote Support components check where messages come from. BeyondTrust says a remote attacker could use it to perform file operations on the appliance, and rates it critical, with a CVSS (Common Vulnerability Scoring System) v4.0 score of 9.3. The Cyber Centre’s alert adds that no password or user action is needed, and that the flaw can allow arbitrary file uploads and potentially full compromise of the appliance.

The same day, Google Threat Intelligence Group and Mandiant published their findings. They say a suspected China-linked espionage group they track as ARMORY CASTLE (formerly UNC5221) exploited the flaw as a zero-day, meaning before a fix existed, starting in late August 2026. In the case Mandiant investigated, Google says the attackers installed a hidden web shell (a small program that gives remote control through the web server), took full control of the appliance, dumped stored credentials, deleted logs, and used it to reach internal systems and copy documents.

On October 16, 2026, the Cyber Centre issued alert AL26-025, saying it has observed open-source reporting that the vulnerability is being exploited in the wild. BleepingComputer reported that BeyondTrust also released a precautionary patch for its Privileged Remote Access (PRA) product, which shares the affected code.

What is not yet known: how many organizations were breached, and whether any are in Canada. Google gives no victim count, and warns that exploitation may widen now that the flaw is public, as it has with this group before.

Who is affected

Organizations that run self-hosted BeyondTrust Remote Support (formerly called Bomgar) version 26.2.3 or earlier. Remote Support is a tool IT teams use to connect to and support computers remotely, so a compromised appliance can become a path into the computers it manages.

Cloud-hosted customers are already patched: BeyondTrust says the fix was applied to all Remote Support SaaS customers as of October 9, 2026. BleepingComputer, citing the Shadowserver Foundation, reported more than 1,400 internet-exposed Remote Support instances, though it is not known how many are already patched.

Many smaller organizations never touch this software directly but are supported by an IT provider who does.

What to do now

If you run BeyondTrust Remote Support yourself:

1. Find every deployment and confirm whether it is SaaS or self-hosted, as the Cyber Centre recommends.
2. Check the version. Anything at 26.2.3 or earlier is affected.
3. Patch. Apply BT26-05-RS from the /appliance interface on versions 24.3.1 to 26.2.3. Older versions must be upgraded to a supported release first. If you also run PRA self-hosted, apply BeyondTrust’s precautionary patch.
4. Preserve evidence, then review. Google recommends snapshotting the appliance and keeping firewall and syslog records before making changes.
5. Look for warning signs: unexpected file activity, unknown administrator or API accounts, and permission changes that raised anyone’s access.
6. If you find anything, rebuild from a clean, patched image, then change appliance, API and single sign-on credentials, as Google advises. Report it to the Cyber Centre through My Cyber Portal or [email protected].
7. Reduce exposure going forward. Google recommends limiting who can reach the /login and /appliance pages and requiring MFA (multi-factor authentication) that resists phishing.

If an IT provider supports you remotely: ask whether they use BeyondTrust Remote Support, whether it is self-hosted, and whether BT26-05 is applied. It’s a short conversation with a clear answer.

What this means for organizations in BC and Alberta

Remote support tools hold credentials and reach many computers, so a compromise can become a privacy question too.

• Federally (PIPEDA): organizations covered by the Personal Information Protection and Electronic Documents Act must report a breach of security safeguards to the Office of the Privacy Commissioner of Canada, and notify affected people, when it creates a real risk of significant harm. They must keep a record of every such breach for at least 24 months.
• Alberta (PIPA): under section 34.1 of the Personal Information Protection Act, an organization must notify Alberta’s Information and Privacy Commissioner without unreasonable delay when a reasonable person would consider there is a real risk of significant harm.
• British Columbia: BC’s private-sector Personal Information Protection Act does not currently require breach reporting, but the Office of the Information and Privacy Commissioner for BC strongly recommends it as a best practice. Public bodies under BC’s Freedom of Information and Protection of Privacy Act (FIPPA) must report breaches that could reasonably be expected to cause significant harm.

For organizations across British Columbia and Alberta, the practical step is the same: patch, check, and keep a written record of what you found.

How happier IT helps

Keeping remote access tools and other internet-facing systems current is part of our patch management service, and our managed security services team watches for the kinds of warning signs described above. If you think something got in, our incident response team can help you investigate calmly and preserve what matters. Not sure where you stand? Start with a free IT assessment.

Sources

• Canadian Centre for Cyber Security: AL26-025, Critical vulnerability impacting BeyondTrust Remote Support (CVE-2026-102764), October 16, 2026
• BeyondTrust: Security advisory BT26-05, October 15, 2026
• Google Cloud Threat Intelligence: ARMORY CASTLE exploits BeyondTrust, October 15, 2026
• BleepingComputer: BeyondTrust patches zero-day exploited in attacks since August, October 16, 2026
• Office of the Information and Privacy Commissioner for BC: Report a privacy breach, accessed October 19, 2026
• Office of the Information and Privacy Commissioner of Alberta: Guidance for notifying the OIPC about a privacy breach under PIPA, April 2024
• Office of the Privacy Commissioner of Canada: What you need to know about mandatory reporting of breaches of security safeguards