BeyondTrust Remote Support zero-day exploited by China-linked APT (CVE-2026-102764)

A critical BeyondTrust Remote Support vulnerability, CVE-2026-102764 (CVSS 9.3), has been exploited as a zero-day and was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on 16 October 2026 with a due date of 19 October 2026. According to SecurityWeek, a China-linked espionage group has abused the flaw since late August.

If you run a self-hosted Remote Support appliance, treat this as a patch-and-investigate task, not only a patch task.

What happened

The flaw is an improper validation of message origins in internal components of Remote Support (CWE-290, authentication bypass by spoofing). Under the right conditions an attacker can perform file operations on the appliance.

SecurityWeek reports the following timeline from BeyondTrust:

• 29 August: first exploitation, against one BeyondTrust-hosted and one self-hosted appliance.
• 28 September: BeyondTrust identified the defect, a day after exploitation against a security device provider became public.
• 30 September: a patch was produced, but testing and work on additional exploitation paths delayed release.
• 8 October: the fix shipped.
• 9 October: the patch had been applied to all Remote Support SaaS customers.

Mandiant and Google Threat Intelligence Group attribute the zero-day exploitation to Armory Castle, a China-linked actor also tracked as UNC5221 and Warp Panda. The group is described as state-sponsored, focused on long-term intelligence gathering and known for targeting SaaS providers, tech companies, government entities, legal services and business-process outsourcers.

Am I affected?

• Affected: all Remote Support versions up to and including 26.2.3.
• Fixed: the BT26-05-RS patch covers versions 24.3.1 through 26.2.3.
• Releases older than 24.3.1: upgrade to a newer version first, then apply the patch.
• SaaS customers: BeyondTrust says the fix has already been applied.
• Self-hosted customers without automatic updates: you must apply the fix manually.

NVD does not list structured affected-product data for this CVE yet, so rely on the vendor advisory for version checks.

Technical details

• CVSS 4.0 score: 9.3 (critical), network attack vector, no privileges and no user interaction required.
• Weakness: CWE-290.
• Exploitation: confirmed, as a zero-day.
• CISA KEV: added 16 October 2026, due date 19 October 2026. Known ransomware campaign use is listed as unknown.
• EPSS: 0.006. This score is low and lags confirmed exploitation, so do not use it to delay patching.

Mandiant and GTIG describe the intrusion as follows: the actor targeted a BeyondTrust device for initial access, deployed the Sawfly PHP webshell and the Bareclaw SOCKS5 tunneler, and gained root-level control of the appliance host. It then harvested credentials, obtained passwordless root privileges to the site service account and deleted system, web server and application logs.

The actor then used compromised administrator credentials to log into the Remote Support application, changed that account’s permissions to control remote systems, and used the built-in support tools and file transfer service to pull sensitive documents such as software inventories from users’ desktops.

Why this matters

Analysis, not reported fact: a remote support appliance sits at a rare intersection of internet exposure, administrative credentials and reach into many endpoints. A compromise here can look like normal support activity, and the log deletion reported in this campaign makes after-the-fact review harder. Exposed self-hosted appliances running 26.2.3 or earlier that are not yet patched deserve the highest priority, within hours rather than days given the KEV listing.

Detection and hunting ideas

No indicators of compromise are included in the material we reviewed. These ideas follow from the reported behaviour:

• Look for unexpected PHP files in web directories on the appliance, which could indicate a webshell like Sawfly.
• Review outbound connections from the appliance for proxy or tunnelling behaviour.
• Check for gaps or truncation in system, web server and application logs, and forward logs off the appliance.
• Audit Remote Support administrator accounts for permission changes and unfamiliar sessions.
• Review file transfer history from endpoints, especially large pulls of inventories or documents.

What to do

1. Identify every Remote Support instance and its version. Anything at or below 26.2.3 is affected.
2. Apply the BT26-05-RS patch (upgrade first if you are older than 24.3.1), using the BeyondTrust advisory.
3. Follow CISA’s required action: apply vendor mitigations, comply with BOD 26-04 and the forensics triage requirements, and discontinue use of the product if mitigations are unavailable. The deadline is 19 October 2026.
4. Because exploitation began on 29 August, hunt for compromise back to at least that date before declaring the appliance clean.
5. If you find signs of compromise, rotate administrator and service account credentials and review which endpoints were accessed.
6. Brief your incident response team and any managed service provider who administers your instance.

Sources for this story are listed below, including the NVD entry and the CISA KEV catalog.

Related coverage

• CISA AA26-281A: China-linked actors exploit 8 known CVEs
• PAN-OS management interface RCE exploited (CVE-2026-0322)
• Windows zero-days CVE-2026-81963, CVE-2026-85880 exploited

Sources

• NVD: CVE-2026-102764
• CISA Known Exploited Vulnerabilities catalog: CVE-2026-102764
• BeyondTrust advisory BT26-05
• SecurityWeek: Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day