BeyondTrust Remote Support Flaw CVE-2026-102764: CISA Says Patch Self Hosted Appliances Right Now
Remote support tools are built to let a technician reach into a computer and fix it. That reach is exactly why attackers love them. On 16 October 2026, CISA urged organisations to patch a critical vulnerability in BeyondTrust Remote Support and added it to the Known Exploited Vulnerabilities catalog the same day. I read CISA’s alert, BeyondTrust’s advisory BT26-05 and BeyondTrust’s detailed incident post in full before writing this.
What is broken
BeyondTrust says the flaw, CVE-2026-102764, sits in internal components of Remote Support that did not properly validate the origin of messages they received. Under the right conditions, a remote attacker could perform file operations on the appliance. BeyondTrust scores it 9.3 under CVSS 4.0 and classifies the weakness as CWE-290, authentication bypass by spoofing. It affects Remote Support versions 26.2.3 and earlier.
CISA uses stronger operational language. It calls this an authentication bypass, says threat actors are actively exploiting it to gain initial access, and then establish persistence, escalate privileges and move laterally. Those four steps describe a full intrusion starting from one exposed appliance. A remote support box often stores or injects privileged credentials across a whole estate, so one compromised appliance can become both a key ring and a map of who connects to what. BeyondTrust’s incident post makes the same point about why this actor wanted in.
Who was hit, and what we know about the actor
BeyondTrust says a suspected China nexus espionage actor exploited this as a zero day. Its timeline says the actor exploited a single BeyondTrust hosted Remote Support instance and a single self hosted appliance on 29 August 2026. BeyondTrust’s team found indications of the hosted incident during a proactive hunt on 28 September and contained that instance within 27 minutes of detection. As of its 16 October update, BeyondTrust says it is aware of only those two impacted customers and has not seen evidence of adversary activity since August.
BeyondTrust assesses with moderate to high confidence that the activity belongs to the actor Google Threat Intelligence Group and Mandiant track as UNC5221, which Mandiant now calls ARMORY CASTLE. CrowdStrike tracks the same cluster as WARP PANDA. BeyondTrust is careful here, and I want to keep its wording intact: attribution rests on tradecraft and behaviour, and this actor rotates infrastructure and tooling for every victim. Mandiant’s account, linked from BeyondTrust’s post, documents a custom web shell and a tunnelling tool, plus file hashes and YARA rules for defenders.
Post exploitation followed a fast, practised pattern: hands on control through a web shell, privilege escalation within minutes, persistence designed to survive a reboot, reading stored credentials, and deleting logs and tooling before leaving. That last habit shapes the advice below. Evidence kept only on the appliance may not survive.
BeyondTrust also shares a working assessment that the actor keeps a model of target products in an AI context to help develop exploit chains. It states plainly that it has no forensic proof of such tooling, and recommends defenders plan as though the assessment is accurate. I am reporting that as the company’s assessment, not as a confirmed fact. It does rhyme with other recent cases where AI shows up near the attack, such as the CLOSEDQUORUM implant that consults AI models, though Talos has not confirmed victims for that one either.
Attackers love remote access gear for the same reason, which is why I also wrote about the Ivanti Connect Secure VPN zero-day.
Who needs to act, and how fast
BeyondTrust says SaaS customers were patched automatically, with the fix applied to hosted Remote Support by 9 October in the advisory, and its blog gives 8 October as the patch release date, so hosted customers need no further action on this patch. Self hosted customers carry the work. Apply the BT26-05-RS patch if your instance is not set to receive automatic updates. The patch covers versions 24.3.1 to 26.2.3. Anyone older than 24.3.1 must upgrade first. BeyondTrust also released the patch for Privileged Remote Access out of caution, because it shares the affected code, even though its testing found no way to exploit that product.
CISA adds urgency for federal agencies and a clear steer for everyone else: patch publicly exposed, high risk flaws first, and check whether threat actors compromised the system before the patch went on. In the KEV catalog entry, CISA lists 16 October as the date added and gives federal agencies a due date of 19 October 2026 to apply the vendor mitigations.
If you also run Jira or Confluence on your own servers, my post on the exploited Atlassian Data Center flaw lists the fixed versions.
What to do
Patch self hosted Remote Support appliances now, and Privileged Remote Access appliances as BeyondTrust recommends. Then reduce exposure: limit external access to only the services your users need, and restrict administrative interfaces to trusted networks.
Next, hunt before you relax. Forward appliance syslog and session events to your SIEM if you have not already, and collect web application firewall, reverse proxy and perimeter firewall logs for the exposure window. Look for unrecognised privileged or administrative sessions, unrecognised script files, unexpected gaps in logs, and unauthorised account, permission or session policy changes. CISA advises isolating a suspected appliance, imaging it, and rebuilding from a known good state with the patch applied.
Finally, treat brokered credentials as exposed if you find anything. Rotate every credential the appliance stored or injected, revoke active support sessions, and review new multifactor authentication registrations on privileged accounts. If you only use the BeyondTrust hosted service, confirm your deployment type with your admin and keep the confirmation on record.
Leave a comment