Your Remote Access and Backup Consoles Are Privileged Accounts

A console that reaches every client you manage is a standing privileged account, and the way to limit it is to shrink what an attacker inherits, because you can't patch faster than a zero-day.

By Levi Rose, Senior Marketing Director, CyberQP. 22 October 2026.

An attacker who takes over a remote support appliance doesn't have to break into your clients one at a time, because the appliance already holds the way in. In an intrusion that Mandiant describes, the attacker logged in to the appliance's admin portal with compromised Administrator credentials, raised a compromised account's roles to Administrator, and then started remote support sessions. A console login is a privileged account that reaches everything the console reaches.

Three Consoles Have Needed Emergency Fixes Since August

In August, N-able said a security issue affected every N-central instance not running 2026.3.1. The page listed indicators of compromise that included a service named Cloudflared and an svchost.exe file in users' Documents folders. On 6 August, N-able said a second hotfix was required even if the first was already installed.

The next was a widely used remote support appliance, disclosed in October. An unauthenticated attacker could run file operations on it, and Rapid7 reports that the two compromises the vendor knows of date to 29 August. The vendor disclosed the flaw on 15 October, 47 days later, and CISA added it to its exploited-vulnerabilities list the next day. Mandiant ties the intrusion to a suspected China-nexus espionage group that left a web shell, escalated to root, tried to extract the appliance's credential vault with the vendor's own utility, and deleted logs.

The third was a management console for a backup product used mainly by MSPs. Huntress saw attackers chain two flaws to run code as SYSTEM, the highest-privileged Windows account, starting on 7 October, three days after the flaws were published. By 8 October it had seen five organizations targeted, with web shells and a cryptominer disguised as a Microsoft Edge updater. The vendor released a hotfix on 12 October. Huntress's write-up doesn't say whether credentials were taken.

Patching Is Necessary and Not Enough

The remote support appliance was exploited for weeks before anyone could install a fix. Even after patching, Mandiant warns that host-level persistence survives a reboot and a configuration reset, and that customers can't audit the appliance's file system, so it recommends rebuilding any appliance that might have been compromised from a clean, patched image.

That leaves what you do control, which is what an attacker gets on the day they take the console. Two things decide that. One is how much standing access technicians hold in client environments. The other is how quickly you can change every credential the console stored or brokered.

Give Technicians Access That Exists Only During the Task

A technician account with permanent admin rights is useful to whoever controls the console, because it is there whether or not anyone is working. Access that is created for a task and removed afterward leaves the attacker with far less to inherit. It doesn't stop someone from starting a session while a task is open, but it removes the accounts that would otherwise exist the rest of the time.

Rotate in the Right Order, and Know the List Before You Need It

Mandiant's advice on sequence is specific: rotate credentials only after the appliance has been patched or rebuilt, because rotating earlier exposes the new credentials to an attacker who still controls it. So the runbook has an order: preserve evidence, patch or rebuild, then rotate everything the console stored or brokered.

The part you can prepare in advance is the list and the method. If every rotation is a manual ticket, the exposure lasts as long as the queue does. If you know which credentials the console holds and can change them in one run, the time between "patched" and "safe" is short.

Where Panthera Fits, and Where It Doesn't

Panthera doesn't secure a remote support or backup console, patch it, or see inside it. It reduces what a compromised console can hand over, and it speeds up the response.

• Time-limited technician access. Just-in-time policies keep technician accounts disabled until a task, and single-use accounts are deleted after it. The access is for accounts in Active Directory, Entra ID, Google Workspace and local machines, not for the console's own login.
• Rotation on demand. Credentials rotate on a schedule or on demand, and the Prompt Terminal™ runs the rotation and clean-up a technician used to do by hand. The vault can also hold API keys, SSH keys and certificates, so credentials that live outside a directory are listed and restricted in one place.
• Restricted, logged access. The vault is restricted to the technicians who need it, access is logged, and Panthera sends privileged account auditing alerts.

Anything the console stored that Panthera doesn't manage still has to be found and rotated by another method.

What to Do This Week

1. List every console that reaches client environments (remote support, RMM, backup, PSA) and write down what credentials each one stores or brokers.
2. Restrict each management interface to trusted IP addresses or a VPN. Huntress recommends this for the backup console, and Mandiant recommends it for the remote support appliance.
3. Require single sign-on with phishing-resistant MFA for console logins, set the default role for new access to none, and alert on any change that raises a user's role. These are Mandiant's recommendations for the remote support appliance and apply to any console that has roles.
4. Send console logs to a system the console can't reach. Mandiant found the attacker deleting logs on the appliance itself.
5. Write the rotation runbook in order: preserve evidence, patch or rebuild, then rotate. Time a rotation on one client so you know the real number.
6. Replace permanent technician admin accounts with access that is created for the task and removed afterward.

To see which standing admin accounts exist in one of your clients, start a free trial and connect it.

Sources

Checked 22 October 2026. Remote support appliance: vendor advisory: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05 · Mandiant: https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust · Rapid7, 19 October: https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild/. Backup console: Huntress, 8 October, updated: https://www.huntress.com/blog/ahsaycbs-flaws-exploit. N-central: N-able status pages, 2 and 6 August: https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/ and https://status.n-able.com/2026/08/06/n-central-2026-3-hotfix-2-additional-mitigation-for-cve-2026-18577/.