Analysis: BeyondTrust zero-day exposes third-party appliance blind spot

A breakdown of the CVE-2026-102764 incident in BeyondTrust: the flaw was exploited, but patching, credentials and logs are often controlled by managed service providers. ZoomEye found 966 hosts with BeyondTrust interfaces, Shadowserver over 1,400 exposed instances.

• ZoomEye: 966 assets titled BeyondTrust, 226 Privileged Remote Access
• Shadowserver counted over 1,400 exposed BeyondTrust instances
• SaaS customers patched 8 October, disclosure on 15 October
• Attackers deleted system, web server and application logs