BeyondTrust has disclosed a critical vulnerability in its Remote Support product after a suspected China-linked espionage actor exploited it as a zero-day. The flaw, CVE-2026-102764, involves improper validation of messages sent to an internal component. Under the right conditions, an unauthenticated remote attacker could use it to perform file operations on an affected appliance. BeyondTrust assigned it a CVSS v4 score of 9.3.
The company's incident account says the actor exploited one BeyondTrust-hosted Remote Support instance and one self-hosted appliance on August 29. As of its October 16 update, BeyondTrust said it knew of those two impacted customers and had not seen evidence of adversary activity since August. That is the vendor's current visibility, not evidence that every exposed appliance was compromised.
What the investigation found
Google Threat Intelligence Group and Mandiant track the actor as ARMORY CASTLE, previously UNC5221. Their investigation describes exploitation followed by the SAWFLY web shell and BARECLAW tunneling malware. The intruder escalated privileges, established persistence and deleted local evidence. BeyondTrust says its own investigation of the hosted instance found a similar pattern, including attempts to reach stored credentials and downstream systems through the appliance.
Remote support infrastructure is a valuable target because it is designed to reach other machines and may hold privileged credentials. Access to an appliance can therefore be more consequential than access to an ordinary application server. The published reports document what investigators saw in specific intrusions; they do not establish that all customer credentials or connected endpoints were exposed.
Who needs to patch
BeyondTrust lists all Remote Support versions through 26.2.3 as affected. The vendor says its SaaS instances were patched by October 9. Self-hosted customers running versions 24.3.1 through 26.2.3 should apply patch BT26-05-RS if it has not already arrived through automatic updates. Older installations must upgrade before applying the patch. BeyondTrust also recommends a precautionary patch for Privileged Remote Access, which shares affected code, although its testing did not identify a working exploit path for that product.
For suspected compromise, patching alone is insufficient. The vendor advises exporting appliance and session logs to an external system, checking for unexpected privileged sessions and web files, and rotating credentials stored or injected by the appliance if exploitation is found. Its post also notes that local logs may have been deleted, making independent copies especially useful to investigators. The advisory remains the authoritative source for affected versions and remediation.