BeyondTrust Remote Support: a zero-day exploited since August lets attackers take over the appliance without an account

BeyondTrust has fixed CVE-2026-102764, a critical flaw in Remote Support that lets an attacker with no account perform file operations on the appliance. According to Google and Mandiant, a suspected China-nexus espionage group has exploited it since late August to steal stored credentials; CISA gave US agencies until 19 October.

What happened

BeyondTrust has fixed CVE-2026-102764, a flaw in internal messaging components of Remote Support, its remote help product formerly known as Bomgar. These components did not properly check where the messages they receive come from, which lets an attacker with no account perform file operations on the appliance. NIST scores it 9.8 (CVSS 3.1); BeyondTrust gives 9.3 in CVSS 4.0. According to Google Threat Intelligence Group and Mandiant, a suspected China-nexus espionage group they call ARMORY CASTLE (formerly UNC5221) has exploited it as a zero-day since late August 2026. CISA added it to its catalogue of exploited vulnerabilities on 16 October, with a deadline of 19 October for US federal agencies.

How the attackers operated

Mandiant describes a web shell dropped on the appliance, a SOCKS tunnel over WebSocket exposed through a modified HAProxy configuration, a root shell and a boot script that survives reboots and configuration resets. The attackers then extracted every secret stored in the Remote Support vault (passwords, API keys), raised the rights of a compromised administrator, used support sessions to reach internal machines and deleted logs.

What to do now

1. Self-hosted appliances: all versions up to 26.2.3 are affected. From 24.3.1, install the BT26-05-RS patch from the /appliance interface; older versions must first move to a supported release.
2. SaaS customers: BeyondTrust patched cloud instances on 9 October, but the exposure period still calls for the checks below.
3. Restrict access to /login and /appliance to known addresses or put them behind a VPN.
4. Look for traces: role changes on Jump Items or teams, new API accounts or security providers, unusual file transfers, unknown .php paths, gaps in forwarded syslog; compare with the indicators published by Google.
5. Rotate secrets after patching: appliance and administrator accounts, API secrets, SAML keys, then every credential stored in the vault.

Our take

A remote support appliance holds the keys to every machine it can reach: taking it over is worth more than any single server. It must be patched within hours, kept off the open internet where possible, and its logs sent to another system so that an intruder cannot erase them.

Sources

• CISA — Known Exploited Vulnerabilities Catalog: CVE-2026-102764
• NIST NVD — CVE-2026-102764
• Google Threat Intelligence Group — ARMORY CASTLE exploits BeyondTrust CVE-2026-102764
• The Record — China-linked hackers exploited BeyondTrust zero-day

How we choose, verify and write our analyses →