Act
active
BeyondTrust Remote Support zero-day exploited since August, patch available
- Engineer — Act: BeyondTrust Remote Support is a PAM/privileged access tool common in enterprise environments; active exploitation since late August means exposure window is already months long — patch immediately and audit RS session logs since late August for unauthorized activity.
- SOC/IR — Act: PAM/remote-support appliances are high-value pivot points; treat any BeyondTrust RS instance as potentially compromised since late August — hunt for anomalous privileged sessions, unexpected account creation, or lateral movement originating from RS hosts.
- Leader — Act: Confirm whether BeyondTrust Remote Support is in your environment, request a vendor attestation on incident scope, and brief leadership — a compromised PAM tool implies potential access to all systems it manages, which is a material risk requiring same-week escalation.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.