BeyondTrust Remote Support zero-day exploited since August (CVE-2026-102764)

BeyondTrust disclosed on October 15, 2026 that a critical flaw in its Remote Support product, CVE-2026-102764, rated 9.3, was exploited as a zero-day starting on August 29 against one BeyondTrust hosted appliance and one self hosted appliance. The flaw is an improper origin validation issue in an internal messaging component that can let an unauthenticated attacker perform file operations on appliances running Remote Support 26.2.3 and earlier.

Mandiant and Google Threat Intelligence Group attribute the activity to Armory Castle, a suspected China nexus espionage group also tracked as UNC5221 and Warp Panda. In the observed intrusions the attackers escalated to root, deployed the SAWFLY webshell and the BARECLAW tunneler, and targeted credentials the appliances store or broker. BeyondTrust says SaaS customers were patched by October 9; self hosted customers must apply the BT26-05-RS patch manually.

Sources: BleepingComputer; SecurityWeek