A critical vulnerability in BeyondTrust Remote Support was exploited on August 29, 2026, nearly seven weeks before it was publicly disclosed on October 15. The flaw, tracked as CVE-2026-102764, has a CVSS 4.0 severity score of 9.3.
Remote Support is used by enterprise IT teams to connect to devices and resolve problems remotely. That makes an exposed support appliance a valuable target: compromising it can provide access not only to the appliance itself but also to credentials and connected systems.
Two compromises are confirmed
According to BeyondTrust’s incident timeline, the attacker exploited the previously unknown flaw against one BeyondTrust-hosted Remote Support instance and one customer-operated appliance on August 29.
BeyondTrust identified signs of the hosted compromise during a threat hunt on September 28 and contained that instance within 27 minutes of detection. Mandiant separately investigated the self-hosted customer’s appliance. When BeyondTrust published its account, it said it knew of only those two affected customers and had found no evidence of attacker activity after August.
Google Threat Intelligence Group and Mandiant attribute the operation to ARMORY CASTLE, formerly tracked as UNC5221. They assess it to be a suspected China-linked espionage actor. That attribution reflects the researchers’ assessment, not a publicly established identity of the people involved.
What the vulnerability allows
BeyondTrust’s BT26-05 security advisory says an internal Remote Support component failed to properly validate the origin of messages it received. Under the right conditions, an unauthenticated remote attacker could perform file operations on an affected appliance.
Mandiant found that the intruders used their initial access to place malicious files, gain elevated privileges, and establish persistent access. The investigation describes a web shell called SAWFLY, a tunneling tool called BARECLAW, attempts to obtain stored credentials, and the deletion of logs to obscure activity.
The risk extends beyond one server. A Remote Support appliance can broker access to other machines, so control of the appliance may give an intruder a route into an organization’s wider network.
Who needs to update
CVE-2026-102764 affects supported Remote Support versions up to and including 26.2.3. BeyondTrust released its BT26-05 fix on October 8 and says the patch had been applied to all Remote Support SaaS customers by October 9.
Organizations running self-hosted installations should confirm that the patch was installed. Those without automatic updates need to apply it manually. Installations older than version 24.3.1 must first upgrade to a supported version.
BeyondTrust also issued a precautionary patch for Privileged Remote Access because it shares the affected code. The company says its internal testing has not identified a way to exploit this vulnerability in that separate product.
Why patching is only the first step
Installing the fix prevents future exploitation of the flaw, but it does not undo a compromise that may already have occurred. Google and Mandiant advise reviewing appliances that were exposed to the internet while running a vulnerable version. Logs forwarded outside the appliance matter especially because the attacker was observed deleting local records.
Where compromise is suspected, administrators should examine account and permission changes, remote support sessions, and stored secrets. Credentials should be rotated after the appliance has been patched or rebuilt; changing them while an attacker still controls it could expose the replacements.
Researchers warn that broader exploitation may follow public disclosure, based on this group’s past behavior. That is a risk assessment, not confirmation that widespread attacks have already begun.