AI analysis
Claude Opus · 5 Nov 2026, 10:20 CET
BeyondTrust Remote Support flaw lets unauthenticated attackers manipulate appliance files
BeyondTrust Remote Support up to version 26.2.3 contains a critical, actively exploited authentication bypass that can let remote attackers perform file operations on the appliance. Apply the vendor's BT26-05 mitigations now and check exposed appliances for compromise.
In plain terms
BeyondTrust Remote Support is a product that IT help desks use to connect to and control other computers remotely. Parts of the software inside the appliance accepted messages without properly checking where they came from. This is called authentication bypass by spoofing: an attacker pretends to be a trusted source, so the software skips the normal login checks.
According to the official description, under the right conditions this could let an attacker perform file operations on the appliance, such as reading, changing or creating files. Because a remote support appliance usually has privileged access to many machines in an organisation, any organisation running BeyondTrust Remote Support version 26.2.3 or earlier should treat this as urgent. CISA has confirmed that the flaw is being exploited.