Your IT provider's remote access: critical flaw (15/10/2026)
On 15 October 2026 BeyondTrust disclosed a critical flaw in Remote Support, the tool many IT providers use to take control of their clients' machines. The next day CISA added it to the catalogue of actively exploited vulnerabilities. The SME affected does not host that tool: its supplier hosts it.
In short
On 15 October 2026 BeyondTrust published advisory BT26-05 and CVE-2026-102764, affecting Remote Support in versions 26.2.3 and earlier[2]. It is rated 9.3 out of 10 under CVSS v4.0 — 9.8 under CVSS v3.1 — and is exploitable over the network, with no account and no user action at all[1]. On 16 October 2026 CISA added it to its Known Exploited Vulnerabilities catalogue, with a remediation deadline of 19 October for US federal agencies[1][4].
Remote Support is the tool an IT provider uses to take over a client's desktops and servers. If you run an SME, that appliance is probably not on your premises: it sits with your supplier. So there is no patch for you to apply, and that is precisely the problem. Supplier remote access is the one entry point into your systems that you neither control nor monitor.
What the flaw actually does
The vendor advisory is terse: internal components of the product did not adequately validate the origin of the messages they received, which under the right conditions could let an attacker perform file operations on the appliance[2]. NIST classifies it as CWE-290, authentication bypass by spoofing[1].
Two details of the rating matter more than the score. First the vector: network, low complexity, no privileges required, no user interaction[1]. In other words, the appliance only has to be reachable. Then the three impacts — confidentiality, integrity, availability — all rated high[1]. A remote-control tool holds, by design, privileged access to every one of its customers: writing a file on that kind of box is never a local incident.
Same week, same family of problem: on 15 October CERT-FR published an advisory on a Cisco AsyncOS flaw in Secure Email Gateway that the vendor also reports as exploited[5]. Edge devices — mail gateways, VPNs, remote-control appliances — attract attacks because they are, by definition, exposed.
Why it is your problem when it is not your server
An SME of ten to two hundred people almost always outsources its IT. The contract covers response times and a monthly fee; it rarely says a word about the security of the tools the provider uses to get into your network. It is the same blind spot we described in our piece on NIS2 and Belgian IT providers, and the same mechanism the suppliers of Albert Heijn lived through during four days of a halted supply chain: the incident happens at a third party, the consequences land on you.
This is not about changing provider. It is about writing down once what you expect on remote access, then checking it once a year. Entities in scope of NIS2 in their country are required to do so under supply-chain security; everyone else simply gains the ability to say who came in, when, and with which account. The Flink breach that started from a former employee's login is a reminder of what one forgotten access costs.
Supplier remote access: the six questions to ask
- Which product do you use to take control of our machines, in which version, and where is it hosted?
- Who applies the patches: you, your own supplier, or the vendor in a hosted deployment?
- How fast do you apply a patch rated critical and known to be exploited? Give me the date of the last one.
- Do your technicians log in with named accounts and two-factor authentication?
- Can I receive a monthly list of sessions opened on our machines: who, when, for how long?
- How, and within what time, will you tell me if your remote-access tool is compromised?
The answers fit in one email. No answer is also an answer.
The four countries: who you report to
| Country | Authority to notify | Our scope guide |
|---|---|---|
| Netherlands | NCSC-NL, under the Cyberbeveiligingswet | NIS2 Netherlands, managed IT services |
| Belgium | CCB and CERT.be | NIS2 Belgium, managed IT services |
| Luxembourg | ILR; the NIS2 act has applied since 10 May 2026[6] | NIS2 Luxembourg, managed IT services |
| France | ANSSI and CERT-FR; as of 21 October 2026 the NIS2 transposition was still before Parliament[7] | NIS2 France, where transposition stands |
In the first three countries an in-scope entity must notify significant incidents to its authority within the deadlines set by national law; in France the NIS2 obligations are still waiting for the act. A personal data breach, however, remains notifiable to the data protection authority — AP, APD/GBA, CNPD, CNIL — regardless of NIS2.
To do this week
- Send the six questions above to your IT provider, in writing, with a reply date.
- Ask for written confirmation that their remote-control tool is up to date, quoting CVE-2026-102764 if it is BeyondTrust Remote Support.
- If you host Remote Support yourself, apply vendor advisory BT26-05 before anything else[3].
- List the remote accesses open to your suppliers — IT, accounting, point of sale, maintenance, alarm monitoring — and close the ones nobody uses.
- Check that every external technician has a named account, never a shared one.
- Record the date of this check in your register: that is the document an authority will ask for.
Chez CyberNovaLabs.io
We frame this work without jargon: an inventory of your suppliers' remote accesses, a provider questionnaire ready to send, and a register of checks kept for you. Our cybersecurity and NIS2 compliance page sets out the method and the scope covered across the four countries. Quoted per engagement, after a thirty-minute first call: tell us about your setup.
Sources
- NIST NVD - CVE-2026-102764 (notation CVSS, inscription au catalogue CISA le 16/10/2026)
- CVE Record CVE-2026-102764 - fiche publiee par BeyondTrust le 15/10/2026
- BeyondTrust - avis de securite BT26-05 (15/10/2026)
- CISA - Known Exploited Vulnerabilities Catalog (ajout du 16/10/2026)
- CERT-FR - CERTFR-2026-AVI-1325, Cisco AsyncOS pour Secure Email Gateway (15/10/2026)
- ILR Luxembourg - la loi NIS2 du 5 mai 2026
- Senat - rapport sur le projet de loi resilience des infrastructures critiques et cybersecurite
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Critical PHP flaws: your website is affected (21/10/2026)
Two critical vulnerabilities in PHP, the engine under most small-business websites, allow unauthenticated remote code execution. Patches shipped on 21 October 2026. What to check this week, and what will never be fixed.
Read the article →October 22, 2026 · 9 min readNIS2 Netherlands: are software vendors and IT providers in scope?
Publishing software is not a listed category in Dutch law. Running a client's infrastructure, hosting it, monitoring it, is. Here is how to settle your own case in ten minutes, with the Dutch dates, the right regulator and the main-establishment rule that decides who inspects you.
Read the article →October 21, 2026 · 9 min readNIS2 France: are construction firms in scope?
Construction divisions 41, 42 and 43 appear in no NIS2 annex, and as of 21 October 2026 France has no transposition law. But division 33 is in there, your French activity code changes on 1 January 2027, and transfer fraud rose 93% in 2025. What actually matters for a building firm.
Read the article →October 20, 2026 · 7 min readGuessed work emails: the CNIL B2B rules (16/10/2026)
On 16 October 2026 the CNIL framed the practice behind half the prospect lists in Europe: guessing a business email address. Legitimate interest still works, under three written conditions.
Read the article →October 20, 2026 · 8 min readProspecting in the Netherlands: B2B appointment setting rules
Article 11.7 of the Dutch telecom act sorts your targets by legal form. Calling a BV is allowed, calling a sole trader needs consent: 76.0% of Dutch businesses are natural persons.
Read the article →October 20, 2026 · 9 min readNIS2 Luxembourg: are hotels and tourism in scope?
Hospitality appears in no annex of Luxembourg's NIS2 Act. Three obligations still reach you, and one of them already decides whether your corporate contracts get renewed.
Read the article →