BeyondTrust Remote Support Zero-Day (CVE-2026-102764) Exploited in Espionage Attacks

On October 15, BeyondTrust disclosed CVE-2026-102764, a vulnerability in Remote Support that was exploited before it was made public. The vendor and Mandiant confirm intrusions dating back to late August. Patch BT26-05 is available, but applying it is not enough on its own: organizations also need to check whether attackers kept their access.

What was disclosed

The flaw comes from insufficient validation of where messages come from in Remote Support’s internal components. It lets an unauthenticated attacker perform file operations on the appliance. Mandiant explains how, after exploiting the flaw, the attackers raised their privileges and set up persistent access.

Researchers attribute the activity to ARMORY CASTLE, a group previously tracked as UNC5221 and suspected of ties to China. They saw the SAWFLY and BARECLAW tools in use, along with log deletion meant to make the intrusions harder to detect. These are the findings of the teams that did the analysis, not a claim made by the attackers themselves.

What’s new is the coordinated disclosure of both the vulnerability and the campaign on October 15. BeyondTrust says the patch was released on October 8, a week before the threat was made public.

Who is affected

The confirmed vulnerability affects Remote Support. The vendor also recommends installing BT26-05 on self-hosted Privileged Remote Access appliances. They share the affected code, although internal testing found no way to exploit the flaw in PRA.

BeyondTrust says cloud-hosted instances of both products were patched automatically. Organizations that run the appliances in their own infrastructure should check the status of their installations. Having the patch in place does not tell you whether a breach already happened.

What to do now

• Review every Remote Support and Privileged Remote Access deployment, including any you run on behalf of clients.
• Confirm that BT26-05 is installed by following the vendor’s instructions. If the patch does not appear in the admin console, contact BeyondTrust support.
• Preserve the logs you have and compare them against Mandiant’s guidance. Look for unfamiliar files, permission changes and changes to remote access settings.
• If you find signs of compromise, start your incident response procedure and assess the risk that passwords and keys accessible through the appliance were exposed.

SecurHUB commentary

Remote support systems deserve particular attention because they act as a gateway to other resources across the organization. Incident response can help determine how far a breach reached and plan how to make the environment trustworthy again.

Sources: BeyondTrust, Google Threat Intelligence Group / Mandiant