China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign

A suspected China-nexus hacker has exploited a zero-day vulnerability in BeyondTrust Remote Support since late August as part of an espionage campaign, according to a report released Thursday by Google Threat Intelligence Group.

The critical vulnerability, tracked as CVE-2026-102764, is related to internal components of Remote Support not being able to confirm the origin of a message.

Self-hosted customers should immediately do a manual upgrade if they have not previously signed up for automatic upgrades, BeyondTrust said.

The agency said the patch affects BeyondTrust Remote Support versions 26.2.3, however noted that the upgrade only works for supported versions 24.3.1 and later.

Self-hosted BeyondTrust customers using older versions must upgrade first to a supported version and then apply the patch.