Nice2GeekYou

Remote-Support Tool Hacked Before Anyone Knew — Check Who Can Remote Into Your PCs

A zero-day in BeyondTrust Remote Support (formerly Bomgar) was exploited for weeks before a patch existed. CISA added it to its must-patch list on October 16. Here's what it means for any business that lets an IT provider remote in.

  • remote-support
  • beyondtrust
  • bomgar
  • zero-day
  • cisa-kev
  • remote-access
  • cybersecurity
  • msp
  • smb
  • managed-it

Attackers broke into BeyondTrust Remote Support (formerly Bomgar), one of the tools IT teams use to remote into computers, more than a month before a fix existed. BeyondTrust disclosed the critical flaw (CVE-2026-102764, rated 9.3 out of 10) on October 15. It says the first break-ins happened August 29. CISA added it to its list of actively exploited vulnerabilities on October 16, and Rapid7 published its analysis on October 19.

Why this one matters

A remote-support tool is a master key. It can reach every computer it manages and often stores the passwords used to log in to them. According to Mandiant, the attackers uploaded hidden backdoors, gained full control of the appliance, tried to pull its stored credentials and deleted logs to cover their tracks. A patch closes the hole, but it doesn't remove a backdoor that's already there.

What to do this week

  1. Ask your IT provider which remote tool they use. BeyondTrust, ConnectWise, Splashtop, TeamViewer and AnyDesk all have legitimate uses. You should know which one can reach your machines.
  2. If it's BeyondTrust and self-hosted, patch now. Apply BT26-05-RS (versions 24.3.1 through 26.2.3); older versions must upgrade first. BeyondTrust says its cloud-hosted customers were patched on October 9.
  3. Check for a break-in, not just the patch. Look for admin sessions you don't recognize, new accounts or permission changes, and gaps in the logs. If anything looks off, rebuild from a clean image.
  4. Change the passwords it stored. Rotate every credential the tool saved or used, and end all open support sessions.
  5. Remove tools nobody uses. Old remote-access apps from a past IT company or a one-time support call are an open door. Uninstall them.

The bigger lesson: whoever can remote into your computers needs to be on a short list you control, with MFA on every account and someone watching the logs.

Nice2GeekYou is based in San Antonio, serving all of Texas, and our managed IT plans support remote clients across the U.S. We inventory remote-access tools, keep them patched and lock them down with MFA. Request a quote or see our monthly plans.

Sources: BeyondTrust — Security Advisory BT26-05; CISA — Urges patching critical vulnerability in BeyondTrust Remote Support; Rapid7 — CVE-2026-102764 exploited in the wild.