A critical BeyondTrust Remote Support flaw was used before it became public. The risk is not limited to the initial file operation: an exposed remote-support appliance can hold or broker privileged credentials and provide a route deeper into an organization.
What is confirmed
BeyondTrust’s 15 October advisory rates CVE-2026-102764 at CVSSv4 9.3. It describes improper origin validation that could let an unauthenticated remote attacker perform file operations on a Remote Support appliance. Google Threat Intelligence Group and Mandiant report evidence that the suspected PRC-nexus espionage actor ARMORY CASTLE exploited it as a zero-day. BeyondTrust’s incident timeline specifies one hosted and one self-hosted Remote Support instance. This is evidence from a limited investigation, not proof of broad victimization.
Mandiant observed follow-on activity including a webshell, a tunneler, attempts to access stored credentials, and efforts to maintain access. The actor also removed local artifacts, making logs held only on the appliance less dependable for investigation.
Who should act
Self-hosted Remote Support versions through 26.2.3 are affected. BeyondTrust says its SaaS customers were patched. Self-hosted customers on 24.3.1–26.2.3 should apply the BT26-05-RS patch; older deployments must first upgrade to a supported version, then patch.
- Patch now and confirm the appliance version and update status.
- Review off-appliance logs, administrator activity, new files, persistence, and outbound connections from any system exposed while vulnerable.
- If compromise is suspected, isolate and investigate the appliance, then rotate credentials it stored or brokered.
- Restrict management access to trusted networks and limit outbound traffic.
Primary sources: BeyondTrust advisory BT26-05 · Google Threat Intelligence Group / Mandiant investigation · BeyondTrust incident timeline.