BeyondTrust has disclosed CVE-2026-102764, a critical flaw in self-hosted Remote Support (RS) that Google and Mandiant say has been exploited as a zero-day since late August 2026 by a China-linked cluster they call Armory Castle. The bug is rated CVSS 4.0 9.3 and lets an unauthenticated remote attacker perform file operations on the appliance. Some reporting says this can be escalated to full control of the host. Public disclosure came on October 15, roughly six weeks after exploitation began.

Reporting on the exact dates conflicts, so treat the timeline as approximate. BeyondTrust patched SaaS tenants itself around October 8-9, and self-hosted customers have to apply the fix themselves.

Technical details

  • Vulnerability class: unauthenticated file-operation flaw in the Remote Support appliance. Public write-ups describe it as a file upload/write primitive reachable without credentials. BeyondTrust has not published request-level detail, and I have not independently verified the exact endpoint.
  • Affected: every self-hosted Remote Support release up to and including 26.2.3, per the BT26-05 advisory as summarized by third parties.
  • Fixed: patch BT26-05-RS, which applies to self-hosted versions 24.3.1 through 26.2.3. It ships as a patch, not a new version number. Installs older than 24.3.1 must upgrade first.
  • Exposure: the appliance is an internet-facing remote-support broker by design, so exposure is the default for most deployments.

Attribution and impact

Google attributes the activity to Armory Castle, with one outlet linking it to UNC5221 / Warp Panda. Targeting is consistent with espionage: credential theft and persistence on a tool that holds privileged access to downstream endpoints. A remote-support server is a high-value pivot. Compromise can expose session recordings, stored credentials, and the ability to push sessions to managed hosts. Google has warned of potential widespread exploitation now that the patch is public and the bug class is easy to reproduce.

One source reports CISA added the CVE to the Known Exploited Vulnerabilities catalog on October 16 with an October 19 deadline. I could not confirm that with a second source, so check the KEV catalog directly.

This is not BeyondTrust’s first appearance in this category: CVE-2026-1731 in Remote Support and Privileged Remote Access was earlier exploited by ransomware operators, so expect rapid weaponization by additional actors.

Mitigation

  1. Apply BT26-05-RS now from the appliance management interface. If you are below 24.3.1, upgrade first, then patch.
  2. Do not treat patching as remediation. The patch does not remove an attacker who already has a foothold. Any internet-exposed self-hosted RS instance that was on a vulnerable build since late August should be treated as potentially compromised.
  3. Hunt: review the appliance for unexpected files or web-accessible artifacts created since late August, unusual admin accounts, new API keys or integrations, and outbound connections from the appliance to unfamiliar hosts. Preserve logs and a disk snapshot before rebuilding.
  4. Rotate secrets: appliance admin and API credentials, service accounts and vaulted credentials, certificates, and any credentials of endpoints the appliance manages. Where compromise is confirmed, rebuild from a clean image rather than cleaning in place.
  5. Reduce exposure: restrict management interfaces to trusted networks and put the broker behind a WAF or reverse proxy that limits unauthenticated paths where the product supports it.
  6. SaaS customers do not need to patch an appliance, but should still review audit logs for anomalous sessions since August.

References