BeyondTrust Remote Support zero-day exploited since August
The lead story is CVE-2026-102764, an authentication bypass by spoofing in BeyondTrust Remote Support carrying a CVSS of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-16 and issued a separate alert urging patching. This is a patch-now item, not a patch-eventually one.
Multiple outlets tie the activity to a suspected Chinese espionage group. SecurityWeek and The Record report a Chinese APT exploited the flaw as a zero-day, and Cyber Security News describes attackers gaining root access and deploying backdoors, with exploitation observed since August. Dark Reading places it in the broader pattern of exploited edge and remote-access bugs. If you run BeyondTrust Remote Support, patch and then hunt: assume attackers who got full admin access in minutes may already be inside.
New CISA KEV additions beyond BeyondTrust
CISA added three vulnerabilities to the catalog over the window. Alongside BeyondTrust, the additions cover Fortinet and Atlassian products.
None of these three are marked ransomware-linked in the facts, but KEV listing means confirmed exploitation. Prioritize the BeyondTrust fix first given the CVSS 9.8 and active Chinese APT use, then close the Fortinet and Atlassian gaps.
- CVE-2026-102764, BeyondTrust Remote Support, authentication bypass by spoofing, CVSS 9.8, added 2026-10-16
- CVE-2025-61624, Fortinet Multiple Products, path traversal, CVSS 6.5, added 2026-10-16
- CVE-2026-21589, Atlassian Multiple Products, files or directories accessible to external parties, CVSS 7.5, added 2026-10-15
Ransomware-linked movers to watch
Several KEV-listed CVEs with ransomware ties are moving on exploitation prediction scores. CVE-2026-41940 in WebPros cPanel and WHM sits at an EPSS of roughly 0.985 with a CVSS of 9.8. CVE-2026-35273 in Oracle PeopleSoft Enterprise PeopleTools reaches about 0.967 EPSS at CVSS 9.8. CVE-2026-63077, a JetBrains TeamCity deserialization flaw, is near 0.896 EPSS, also CVSS 9.8 and ransomware-linked.
Also notable: CVE-2026-104935, an Ivanti Connect Secure authentication bypass, tops the hot list and is KEV-listed. If any of these products touch your estate, they move ahead of routine patching.
Stolen credentials and fake Microsoft alerts
Cyber Security News reports attackers used compromised ConnectWise backup credentials to break into 173 Microsoft 365 accounts. This is a reminder that your identity layer is only as strong as the third-party tools holding tokens and credentials into it. Review conditional access, token lifetimes, and which integrations hold standing access to Entra ID.
Separately, attackers are abusing roughly 20,000 Cloudflare Pages domains to push fake Microsoft security alerts. Warn your users and tune detections for lookalike Microsoft branding.
Microsoft Office patches and this month's rollups
SecurityWeek reports Microsoft patched two dozen remote code execution flaws in Office. The current KEV-flagged cumulative updates include KB5126646 for Windows Server 2025, KB5126655 for Windows Server 2022, KB5126657 for Windows 10 Version 21H2, and KB5126651 for Windows 10 Version 1809. Confirm these are deployed across your fleet.
Senserva's free Microsoft Patch Tracker ranks open Microsoft patches by CISA KEV, EPSS, and ransomware linkage so you can confirm your own state after today's adds, and the non-Microsoft exploited-CVE tracker follows KEV additions like the BeyondTrust, Fortinet, and Atlassian entries daily.
Do this first
Work the exploited items in order of blast radius and confirmed use.
- Patch BeyondTrust Remote Support for CVE-2026-102764 now, then hunt for root access and backdoors given exploitation since August
- Apply fixes for the Fortinet CVE-2025-61624 and Atlassian CVE-2026-21589 KEV adds
- Rotate ConnectWise and other third-party credentials with access to Microsoft 365, and review Entra ID conditional access
- Deploy the Windows cumulative updates KB5126646, KB5126655, KB5126657, and KB5126651, plus the Office RCE patches
- Prioritize ransomware-linked KEV movers CVE-2026-41940, CVE-2026-35273, and CVE-2026-63077 if those products are present
Sources
- Cyber Security News: Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors (2026-10-16)
- Cyber Security News: BeyondTrust 0-Day Vulnerability Exploited Since August to Gain Full Admin Access in Minutes (2026-10-16)
- SecurityWeek: Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day (2026-10-16)
- The Record: Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day (2026-10-16)
- Dark Reading: BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs (2026-10-16)
- Cyber Security News: Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts (2026-10-17)
- Cyber Security News: Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts (2026-10-16)
- SecurityWeek: Microsoft Patches Two Dozen RCE Flaws in Office (2026-10-16)
- CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-16)
- CISA Cybersecurity Advisories: CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support (2026-10-16)
Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-17.
Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.