BeyondTrust CVE-2026-102764: Remote Support Zero-Day Used Since August

On 15 October 2026 BeyondTrust published advisory BT26-05 for CVE-2026-102764, a critical flaw in its Remote Support product. CISA added it to the Known Exploited Vulnerabilities catalog on 16 October with a federal due date of 19 October.

This was a zero-day. BeyondTrust says a suspected China-nexus espionage actor exploited it on 29 August against one BeyondTrust-hosted instance and one self-hosted appliance. It attributes the activity, with moderate to high confidence, to the cluster Mandiant now calls ARMORY CASTLE, previously tracked as UNC5221.

What's affected

• Product: BeyondTrust Remote Support (RS).
• CVE: CVE-2026-102764, CWE-290 authentication bypass by spoofing. CVSS 4.0 base score 9.3, network, no privileges, no user interaction.
• Issue: internal messaging components did not adequately validate the origin of messages they received. Under the right conditions, an attacker can perform file operations on the appliance. BeyondTrust is withholding further technical detail while customers patch.
• Affected versions: the advisory lists all versions before 26.2.3. The CVE record lists versions up to and including 26.2.3.
• Fix: the BT26-05-RS patch, which covers 24.3.1 through 26.2.3. Instances older than 24.3.1 must upgrade before they can apply it.
• SaaS: patched for all Remote Support SaaS customers as of 9 October, per the advisory.
• Privileged Remote Access: BeyondTrust says PRA shares the affected code. Its testing found no way to exploit it there, but it released a PRA patch too and recommends self-hosted PRA customers apply it immediately.

BeyondTrust's timeline: exploitation on 29 August; its threat hunting found the affected SaaS instance on 28 September and contained it within 27 minutes; Mandiant confirmed findings from the self-hosted victim on 30 September; the patch shipped on 8 October; coordinated disclosure on 15 October. BeyondTrust says it is aware of only those two affected customers and has seen no actor activity since August.

How to check if you're exposed

1. Log in to the /appliance interface of each self-hosted Remote Support and PRA appliance. Check the version and whether BT26-05 appears in the installed updates.
2. Check whether the appliance is subscribed to automatic updates. The advisory says self-hosted customers must apply the patch manually if it isn't.
3. If the version is below 24.3.1, the patch will not install. Upgrade first.

Then hunt. BeyondTrust says this actor uses a zero-day selectively and then typically moves to broad exploitation of unpatched instances once the bug is public, and that Mandiant warns defenders to expect the same here. BeyondTrust says indicators from one intrusion rarely reappear in the next, so it recommends hunting for behavior:

• Privileged or administrative sessions from residential broadband or commercial VPN addresses you can't tie to a known admin or ticket.
• Unrecognized script files in web directories, and web service accounts spawning shells.
• Unauthorized account, permission or session policy changes, especially to Jump Items or Teams.
• Gaps in log forwarding that start and end within a single session.

That last item matters. BeyondTrust says the actor deletes local logs and its own tooling before leaving. Evidence on the appliance may be missing or tampered with. Off box syslog and SIEM copies are often the only reliable record.

What to do now

1. Apply BT26-05-RS to every self-hosted Remote Support appliance today. Apply the PRA patch to self-hosted PRA appliances as well.
2. Restrict administrative interfaces to trusted networks and expose only what users and customers need to reach. Limit outbound traffic from the appliance to required destinations.
3. Forward appliance syslog and session events to your SIEM in near real time if you don't already.
4. Run the behavior hunts above over logs from 29 August onward. BeyondTrust customers can request its threat hunting package for this actor through the trust portal, and Mandiant has published hashes and YARA rules for the actor's tooling.
5. If you find anything, image the appliance before rebuilding. Rotate every credential the appliance stored or injected, watch those accounts for logins outside managed sessions, and review new MFA registrations on privileged accounts. BeyondTrust asks for a Sev 1 support request citing "BT26-05".

Why it matters

Remote access appliances broker privileged credentials across an estate. BeyondTrust's own description is blunt: the appliance is a credential source and a map of who connects to what. Compromising one gives an attacker a ready-made path to the systems that matter most.

BeyondTrust's write up also includes an uncomfortable detail. Its sensors fired in real time when the actor escalated privileges, but an automated triage layer in a third party detection platform closed those alerts as false positives. Its advice: treat a triage verdict as one input, keep closed alerts in scope for hunts, and run a hunting program on its own cadence.

Try it yourself

Pick one high value appliance in your environment and check where its logs go. If the only copy lives on the box, an attacker who reaches admin can erase the evidence. Set up forwarding, then confirm you can see one login event from that appliance in your SIEM within a minute.

This demo shows how a vendor's security posture and incidents feed into ongoing vendor monitoring:

Click through it at your own pace, or open it full screen.

Quick check

Sources

• BeyondTrust Security Advisory BT26-05
• BeyondTrust: ARMORY CASTLE and BT26-05, What Security Teams Need to Know
• CVE-2026-102764 record
• NVD: CVE-2026-102764
• CISA Known Exploited Vulnerabilities Catalog