BeyondTrust patches critical zero-day in Remote Support exploited since August
CVE-2026-23336 allows privilege escalation; active exploitation confirmed in the wild
Key Takeaways
- BeyondTrust has patched CVE-2026-23336, a critical privilege escalation flaw in Remote Support (RS).
- Active zero-day exploitation has been confirmed in the wild since late August 2026.
- Successful exploitation could allow an attacker to gain elevated privileges on the affected system.
- Customers are urged to update to the latest patched version of BeyondTrust Remote Support immediately.
Quick answers
- What happened?
- BeyondTrust has released patches for a critical vulnerability in its Remote Support (RS) product that has been exploited as a zero-day since late August 2026. The flaw, tracked as CVE-2026-23336, allows privilege escalation and affects versions of the Remote Support software used for remote technical support and access.
- Which products are affected?
- Remote Support (RS)
- What should defenders do?
- BeyondTrust has released patches for BeyondTrust Remote Support (RS). Customers are urged to update to the latest version immediately. Apply the patch as soon as possible to mitigate the risk of active exploitation.
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. The vulnerability, identified as CVE-2026-23336, is a privilege escalation flaw. Exploitation of the vulnerability could allow an attacker to gain elevated privileges on the affected system. BeyondTrust confirmed active exploitation in the wild but has not disclosed detailed exploit mechanics. Patches have been released for BeyondTrust Remote Support (RS); customers are urged to update to the latest version immediately to mitigate the risk. The product is used for remote technical support and access. The advisory was reported by BleepingComputer on October 16, 2026. No further details on the exploit methodology or threat actor attribution have been released.
Security Details
CVE-2026-23336 is a privilege escalation vulnerability in BeyondTrust Remote Support (RS). Exploitation could allow an attacker to gain elevated privileges on the affected system. The flaw has been exploited as a zero-day since late August 2026. BeyondTrust has released patches; detailed exploit mechanics have not been disclosed.
Affected products
Remote Support (RS)
Mitigation
BeyondTrust has released patches for BeyondTrust Remote Support (RS). Customers are urged to update to the latest version immediately. Apply the patch as soon as possible to mitigate the risk of active exploitation.
Sources
BleepingComputer
BeyondTrust patches zero-day exploited in attacks since August
Oct 16, 2026 · 06:18
Original link
Related Security News
Drupal patches critical RCE flaws, warns of imminent exploitation
Drupal has released security updates addressing two critical remote code execution vulnerabilities. The vendor warns that active exploitation may emerge soon, urging administrators to apply patches immediately.
CISA Issues Urgent Warning for Actively Exploited Ivanti Zero-Day Flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Ivanti Connect Secure and Ivanti Policy Secure to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild since at least October 1st, 2024. The agency has issued Binding Operational Directive (BOD) 24-01 requiring federal civilian executive branch agencies to patch the flaw within a specified timeframe. Ivanti has released security updates addressing the vulnerability, which affects Connect Secure, Policy Secure, and Neurons platforms.
