Intelligence

Philips reports no known impact from the exploited BeyondTrust and Ivanti flaws

MedDevice Cyber Staff · Oct 19 · 4 min read · Via Philips product security advisories

Philips posted two short notices on its product security page. The first, dated October 15, covers CVE-2026-104935 in Ivanti Connect Secure. The second, dated October 19, covers CVE-2026-102764 in BeyondTrust Remote Support and links to BeyondTrust's advisory. Both say that no Philips products are known to be impacted at this time, and neither lists versions or mitigations.

BeyondTrust disclosed CVE-2026-102764 on October 15. It is an authentication bypass by spoofing (CWE-290) in Remote Support, scored 9.3 on CVSS v4.0 according to Rapid7. Internal components do not adequately validate where incoming messages come from, which permits file operations on the appliance. Versions 26.2.3 and earlier are affected unless the BT26-05-RS patch is applied, which covers 24.3.1 through 26.2.3. BeyondTrust says Remote Support SaaS customers were patched as of October 9. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16 with an October 19 due date.

BeyondTrust confirmed exploitation before disclosure. Its October 16 report dates two known compromises to August 29: a BeyondTrust-hosted instance, found and contained on September 28, and a self-hosted appliance. Mandiant shared corroborating findings from the self-hosted investigation on September 30, and attributes the activity to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221. In Rapid7's account of those findings, the activity included file uploads, the SAWFLY web shell, the BARECLAW tunneler, root escalation, and log deletion. Rapid7 advises investigating for prior compromise even after patching and says patching does not remove persistence.

Ivanti disclosed CVE-2026-104935 on October 13, and CISA added it to the same catalog that day. It is an authentication bypass by spoofing (CWE-290) in Connect Secure that lets a remote, unauthenticated attacker run arbitrary commands, scored 8.6 on CVSS v3.0 per Rapid7. Ivanti fixed it in 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5, depending on branch; versions 22.7.x and below are unaffected. Ivanti says a limited number of customers were hit before disclosure, and Volexity detected the activity in early October. As of Rapid7's October 13 post, Volexity reported that the actor also used a separate privilege escalation flaw that was not yet patched. Ivanti plans to fix it later.

Philips' statement covers products. A manufacturer's own service access tools are a separate question, and both of these flaws sit in that kind of tool. A remote support appliance and a remote-access gateway each hold credentials and sessions that reach into customer networks. If your field service path runs through either one, patch it. Hunt for compromise even after patching, and rotate the credentials the appliance stored or brokered.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Patch BeyondTrust Remote Support with BT26-05-RS (covering 24.3.1 through 26.2.3) and Ivanti Connect Secure to 25.1.1.2, 25.1.3.0, 25.1.3.1, or 22.8R2.5 by branch, on an emergency basis. Both vendors report exploitation before disclosure. Rapid7 advises checking for compromise even after patching and says patching does not remove persistence on the BeyondTrust appliance, so investigate any appliance that ran an affected build for prior compromise.

Patch outside the normal cycle. Apply BT26-05-RS to Remote Support 24.3.1 through 26.2.3, and move Connect Secure to the fixed build for your branch. Rapid7 recommends emergency patching for both.
Hunt for compromise after patching. Look for unrecognized admin sessions, unexpected scripts in web directories, unauthorized account or policy changes, and gaps in log forwarding. Volexity has published indicators for the Ivanti activity.
Rebuild and rotate if compromise cannot be ruled out. Preserve evidence, isolate the appliance, rebuild from a clean, fully patched image, and rotate the credentials the appliance stored or brokered.
Forward appliance logs off the box. Send logs to an external SIEM and keep any existing external copies, since the reported BeyondTrust activity included log deletion.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Properties

PID-41 PID-331 PID-4111 PID-27 PID-28 PID-33

Fix the class in your product

The device is fine; the backend decides who gets in. As the maker, verify the password against a stored hash before issuing a token, put every function and object behind a server-side authorization check, and rate-limit. Assume any account reachable before the fix was reached.

Verify credentials server-side. Return a token only on a real hash match, never on a format or shape check.
Authorize every endpoint and object. No route trusts a client assertion of identity or role; scope tokens and make them short-lived.
Throttle and lock out. Add rate limiting and lockout so credentials cannot be brute-forced.

Mapped EMB3D mitigations

Questions & Answers

Are Philips products affected by BeyondTrust Remote Support CVE-2026-102764?

Philips said on October 19, 2026 that no Philips products are known to be impacted by CVE-2026-102764 at this time. CVE-2026-102764 is an authentication bypass in BeyondTrust Remote Support (advisory BT26-05) that CISA added to its Known Exploited Vulnerabilities catalog on October 16, 2026.

Is Ivanti Connect Secure CVE-2026-104935 being exploited?

Yes. Ivanti reported exploitation before disclosure that affected a limited number of customers, and CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, 2026. Philips said on October 15 that no Philips products are known to be impacted. Ivanti fixed the flaw in 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5, depending on branch.

Which BeyondTrust Remote Support versions does patch BT26-05-RS cover?

BT26-05-RS covers Remote Support 24.3.1 through 26.2.3, and BeyondTrust says versions 26.2.3 and earlier are affected unless it is applied. Older instances must first upgrade to a patch-supported version. Rapid7 notes that patching does not remove persistence, so appliances should be checked for prior compromise.

← Back to Intelligence