Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
A Chinese APT has been exploiting a BeyondTrust vulnerability as a zero-day since August as part of its state-sponsored espionage operations.
The exploited flaw, tracked as CVE-2026-102764 (CVSS score of 9.3), is described as an improper validation of message origins that could allow attackers to perform file operations on Remote Support (RS) appliances.
According to BeyondTrust, all RS versions up to and including 26.2.3 are affected. Fixes for the bug were included in the BT26-05-RS patch for versions 24.3.1 through 26.2.3. Customers on releases older than 24.3.1 should upgrade to a newer version and then apply the patch.
BeyondTrust identified the security defect on September 28, one day after its exploitation against a security device provider became public. However, initial exploitation occurred on August 29, against one BeyondTrust-hosted and one self-hosted RS appliance.
The company says it produced a patch by September 30, but took its time to test it...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
