BeyondTrust Urges Immediate Patch After Zero‑Day Exploits Target Remote Support Tool

BeyondTrust has issued an urgent advisory urging its users to apply a critical update to the Remote Support (RS) component of its software suite, after confirming that the flaw has been weaponised in active zero‑day attacks since late August.

The vulnerability resides in the way the RS module authenticates incoming connections, allowing an unauthorised actor to bypass security checks and gain remote access to a victim's system. Exploitation does not require user interaction beyond the presence of the vulnerable client, making it particularly attractive to threat actors seeking stealthy footholds in corporate networks.

Security researchers first observed anomalous traffic patterns linked to the flaw in early September, and subsequent forensic analysis traced a series of intrusion attempts back to the same weakness. While BeyondTrust has not disclosed the exact number of compromised installations, the company confirmed that the attacks have been ongoing for several weeks, targeting organisations across multiple sectors that rely on remote assistance for IT support.

In response, BeyondTrust released a patch on Thursday and sent out a direct notification to all registered customers, outlining step‑by‑step instructions for remediation. The vendor stressed that the update addresses the authentication bypass and recommends that administrators deploy it without delay, alongside standard hardening measures such as network segmentation and multi‑factor authentication for remote sessions.

Experts say the incident underscores the persistent risk posed by unpatched remote‑access tools, especially as cyber‑criminals continue to hunt for zero‑day exploits that can be leveraged at scale. Organisations are advised to audit their remote support configurations, verify that all software components are current, and monitor network logs for any signs of irregular remote connections. Ongoing vigilance will be essential as security teams watch for potential follow‑up attacks that could target similar vulnerabilities in other widely used management utilities.