BeyondTrust Remote Support 0-Day CVE-2026-102764 Patched

BeyondTrust Remote Support versions up to and including 26.2.3 contain a critical zero-day vulnerability tracked as CVE-2026-102764. This flaw allows unauthenticated remote attackers to perform file operations on affected appliances, potentially leading to full host control. The BeyondTrust company released a patch on October 8 to address the issue, which stems from an internal messaging component that failed to properly validate message sources.

In plain English

The vulnerability exists in how the software handles internal messages. Because the system did not check where incoming messages originated, attackers could send malicious commands without logging in. This allowed them to execute file operations on the appliance. Once inside, attackers could escalate their privileges to root level, giving them complete control over the device and access to stored credentials.

The background

The ARMORY CASTLE group, a suspected China-linked espionage actor also known as UNC5221 or WARP PANDA, exploited this weakness starting on August 29. They targeted both hosted and self-hosted instances. BeyondTrust detected activity on a hosted instance on September 28 and contained the incident within 27 minutes. Mandiant notes that the group has previously targeted edge devices and remote-access products, suggesting a pattern of exploiting systems that sit between the internet and internal networks.

What changes now

BeyondTrust released the fix on October 8. All Remote Support SaaS tenants were patched by October 9. Self-hosted customers must verify their appliance versions and apply the relevant update manually. The vendor has not published technical details of the flaw to protect customers who have not yet patched. Mandiant warns that opportunistic exploitation may increase now that the vulnerability is public.

Who needs to act first

Security teams should prioritize updating internet-facing appliances that handle remote support connections. Before applying the patch, create backups of appliance configurations to allow for quick recovery if issues arise. Test the update in a non-production environment first to ensure stability. Monitor network traffic for unusual file operations or privilege escalation attempts, as attackers may continue targeting unpatched systems. Verify that all self-hosted instances are running the latest patched version.

Background: Privilege escalation attacks

Monitor for unexpected process spawning from low-privilege contexts, changes to system binaries, and abnormal access to sensitive configuration files. Correlate these signals with user behavior baselines to catch lateral movement before it becomes a full compromise.

Read the full guide: Detect Privilege Escalation Attacks: Log Signals and Blind Spots

What to do and how to stay safe: BeyondTrust

• Check your BeyondTrust Remote Support appliance version and compare it against the patched release notes.
• Apply the October 8 patch to all self-hosted appliances immediately if they are running version 26.2.3 or earlier.
• Review logs for any unauthorized file operations or privilege escalation events since late August.
• Monitor for new threat intelligence related to ARMORY CASTLE or UNC5221 activity in your environment.

Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits

General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of BeyondTrust Remote Support are affected by CVE-2026-102764?

Supported versions up to and including 26.2.3 are affected by this vulnerability.

Who exploited this zero-day vulnerability?

The ARMORY CASTLE group, a suspected China-linked espionage actor, exploited the flaw starting in late August.

Is there a patch available for this vulnerability?

Yes, BeyondTrust released a patch on October 8, and all SaaS tenants were patched by October 9.