BeyondTrust has remediated a critical vulnerability in its Remote Support product after the flaw was exploited as a zero-day in late August, according to the company and Google Cloud’s Mandiant threat intelligence team.
The vulnerability, tracked as CVE-2026-102764, carries a CVSSv4 score of 9.3 and affects Remote Support versions 26.2.3 and earlier. BeyondTrust’s October 15 advisory, BT26-05, describes the issue as improper origin validation in an internal messaging component that could allow a remote attacker to perform file operations on an affected appliance.
The Canadian Centre for Cyber Security issued alert AL26-025 on October 16 and described CVE-2026-102764 as an Authentication Bypass by Spoofing vulnerability, classified as CWE-290. The Cyber Centre said successful exploitation may allow a remote, unauthenticated attacker to perform unauthorized file operations without user interaction, including arbitrary file uploads that could result in full compromise of the appliance.
BeyondTrust said it is withholding technical details while self-hosted appliances are still being patched.
Patch status is split between SaaS and self-hosted deployments
BeyondTrust says it released the BT26-05 patch to SaaS and self-hosted customers on October 8. Its advisory says a patch had been applied to all Remote Support SaaS customers as of October 9. The Canadian Cyber Centre also said BeyondTrust confirmed the patch was applied to all Remote Support SaaS and Privileged Remote Access SaaS customers as of October 9, meaning those SaaS customers do not need another action to apply the fix.
Self-hosted Remote Support customers still need to verify their own patch status. Systems running versions 24.3.1 through 26.2.3 need the BT26-05-RS patch. BeyondTrust says self-hosted instances not subscribed to automatic updates should manually apply the patch through the /appliance interface. Remote Support versions older than 24.3.1 must be upgraded to a newer supported version before the patch can be applied.
The formal advisory lists Remote Support as the impacted product. BeyondTrust’s incident blog says Privileged Remote Access shares the affected code, although internal testing had not identified a way to exploit the vulnerability in Privileged Remote Access. As a precaution, BeyondTrust released a patch for Privileged Remote Access and recommends that self-hosted Privileged Remote Access customers apply it immediately.
The exploitation reports raise the stakes
BeyondTrust said the actor exploited the zero-day on August 29 against one BeyondTrust-hosted Remote Support instance and one self-hosted Remote Support appliance. In its October 16 update, the company said it was only aware of those two impacted customers and had not seen evidence of adversary activity since August.
Mandiant and Google Threat Intelligence Group attributed the zero-day exploitation and related tooling to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221. Mandiant said it observed the actor escalate privileges, establish persistent access, attempt to harvest credentials from the appliance’s secrets database, delete logs, and abuse administrative access to support movement into downstream systems.
The Canadian Cyber Centre also reported that the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16.
Mandiant warned organizations to prepare for possible broader exploitation now that the flaw is public. That warning matters even though the publicly confirmed customer count is currently limited, because edge and remote-access appliances are common targets once technical details begin circulating.
Checks that matter after patching
Patch verification should be paired with exposure and compromise review, especially for appliances that were reachable from the internet while running a vulnerable version. A compromised support appliance may expose stored secrets, trusted administrative workflows, session history, and routes into machines that the support platform is designed to reach. BeyondTrust and Mandiant guidance points to several checks that deserve priority:
Review administrative access to /login and /appliance, and restrict those interfaces to trusted networks wherever possible.
Forward appliance syslog and session events to an external SIEM or log platform, since the reported actor deleted local logs and artifacts.
Look for unrecognized privileged or administrative sessions from residential broadband or commercial VPN addresses.
Check for unrecognized script files in web directories, web service accounts spawning shells, and unexpected permission changes involving Jump Items or Teams.
Investigate short gaps in log forwarding, especially gaps that begin and end within a single session.
If there is evidence of exploitation, credential handling becomes part of the response. BeyondTrust advises treating every credential the appliance stored or injected as exposed. Mandiant also recommends rotating credentials only after the appliance has been patched or rebuilt, so new secrets are not handed to an attacker who may still control the system.
Organizations that find signs of exploitation should preserve evidence before rebuilding and contact BeyondTrust support with a Sev 1 request that references BT26-05, according to the company’s guidance.
Remote-access and privileged-access systems need shorter patch windows, tighter network exposure, and stronger off-box logging than ordinary business applications.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
