BeyondTrust Zero-Day: What Texas SMBs Must Do Now (2026)

According to public reporting on BeyondTrust advisory BT26-05, the flaw is an authentication bypass that lets an unprivileged remote attacker perform file operations on unpatched appliances. Versions 26.2.3 and earlier on self-hosted installations are affected. BeyondTrust patched its SaaS customers on October 8, but self-hosted appliances must be updated manually unless automatic updates are enabled.

Researchers attribute the activity to a suspected China-nexus espionage group. After gaining access, the attackers reportedly escalated to root, planted a web shell and a tunneling tool, wiped logs, and moved laterally using stolen administrator credentials. Scanning data shows well over a thousand BeyondTrust remote support instances exposed to the internet. Treat any unpatched, internet-facing appliance as potentially compromised, not just vulnerable.

Remote support platforms exist to reach into your endpoints, servers, and sometimes domain controllers with high privilege. That makes them a single point of failure. A flaw in the appliance can hand an attacker the same reach your technicians have, often with credentials stored for convenience. We covered the same pattern in our guide to hardening AnyDesk and ConnectWise remote support, and it applies equally here. This is also the same shape of risk described in our look at edge device exploitation: an internet-facing system with deep internal trust.

1. Find out if you are exposed. Ask your IT provider whether you, or any vendor supporting you, run a self-hosted BeyondTrust Remote Support or Privileged Remote Access appliance, and which version.
2. Patch immediately. Apply the update referenced in advisory BT26-05, and turn on automatic updates so the next fix does not wait on a person.
3. Restrict exposure. If the appliance does not need to be reachable from the whole internet, limit it by IP allow list or place it behind a zero trust gateway.
4. Hunt for signs of compromise. Look for unexpected files, new web shells, unusual administrator logins, and gaps in logs. Missing logs are themselves a warning sign.
5. Rotate credentials. Reset service accounts, vaulted credentials, and any administrator password the appliance could access. Patching does not remove an attacker who is already inside.
6. Notify your insurer if you find evidence. Many cyber policies require prompt notice, as outlined in our cyber insurance requirements guide.

You cannot patch a flaw before the vendor knows it exists, so design for the day a trusted tool turns against you.

• Least privilege for support accounts. Technicians and tools should not use domain admin by default. See our least privilege guide and the privileged access management overview.
• Segment the network. A support server should not be able to reach every device. Network microsegmentation keeps one compromise from becoming all of them.
• Replace broad exposure with zero trust access. Our ZTNA practitioner guide explains how to stop publishing admin tools to the internet.
• Keep logs somewhere an attacker cannot erase. This attack wiped local logs. Forward them off the appliance, as described in our log retention and SIEM data sources guide.
• Know who is watching. Compare options in our SIEM, MDR, and XDR comparison.

If a vendor manages your systems, ask which remote access tools they use, whether those run in your environment or theirs, how quickly they patch internet-facing systems, and where their logs are stored. A good provider answers in minutes. Vague answers are a reason to dig deeper. Remember that your risk includes the tools your vendors use to reach you, not only your own appliances.

Today, inventory every remote access tool that can reach your network, confirm each is patched, and rotate the credentials those tools can use. If you want a second set of eyes, our cybersecurity services team can run a rapid exposure review, and our managed IT services keep patching and monitoring on a schedule. For benchmarks on how peers handle these controls, see the Texas SMB IT and cybersecurity benchmark. Houston-area teams can start with our Houston managed IT team.

• Houston managed IT
• Katy managed IT
• The Woodlands managed IT