Act now:BeyondTrust Remote Support CVE-2026-102764 Zero-Day. Organizations running self-hosted BeyondTrust Remote Support (any version through 26.2.3), and self-hosted Privileged Remote Access as a precaution.
Check exposure:Siemens Software Center DLL Flaw Abused in ClickFix Attacks. Security teams with Windows endpoints, since attackers bring the vulnerable signed program themselves, and organizations that run Siemens Software Center for Siemens engineering software.
Do you run any of these? Atlassian Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-18.
If you run a self-hosted BeyondTrust Remote Support appliance, patch it today and assume it may already be compromised; an espionage group used this as a zero-day for about seven weeks.
Must act: Organizations running self-hosted BeyondTrust Remote Support (any version through 26.2.3), and self-hosted Privileged Remote Access as a precaution.
Can relax: Teams that do not use BeyondTrust; SaaS customers need no patch (BeyondTrust patched them by October 9) but should still review admin changes and stored credentials.
Inventory every Remote Support and Privileged Remote Access deployment, whether it is SaaS or self-hosted, and its version.
Apply BT26-05-RS to self-hosted Remote Support today (upgrade to 24.3.1 or later first if older), and confirm it in the /appliance interface.
Preserve logs and a snapshot before patching or rebooting any appliance that was internet-reachable while unpatched.
Siemens users get the fix automatically, but the real threat is attackers shipping their own signed, older copy as a malware loader, so Windows defenders should block the indicators and hunt rather than rely on patching.
Must act: Security teams with Windows endpoints, since attackers bring the vulnerable signed program themselves, and organizations that run Siemens Software Center for Siemens engineering software.
Can relax: Teams with no Windows endpoints; Siemens Software Center users whose installs have updated to 4.0.9.8 or later and whose hunts find none of the indicators.
Start Siemens Software Center on every machine that has it so it auto-updates to 4.0.9.8 or later, and confirm the version.
Block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127 on firewalls, proxies and DNS resolvers.
Hunt for SiemensSoftwareCenter.exe running from AppData\Local\Programs or launched by msiexec, and for Siemens Software Center startup entries on PCs that never had it.