CVE-2026-102764 BeyondTrust: Critical Flaw Exploited as a Zero-Day
According to Mandiant, a critical vulnerability in BeyondTrust Remote Support was exploited before a fix was disclosed. Administrators of self-hosted appliances should deploy the update and check for possible signs of compromise.
CVE-2026-102764 BeyondTrust is a critical vulnerability in the Remote Support tool that, according to Google Threat Intelligence Group (GTIG) and Mandiant, was exploited by an actor identified as ARMORY CASTLE before the flaw was publicly disclosed. BeyondTrust issued security advisory BT26-05 and a fix on October 15, 2026.
The flaw has a CVSSv4 score of 9.3 and affects BeyondTrust Remote Support version 26.2.3 and earlier. A remote unauthenticated attacker could use it to perform file operations on the appliance, meaning the server or virtual device running the service.
CVE-2026-102764 BeyondTrust was exploited in late August
GTIG/Mandiant states that ARMORY CASTLE exploited the vulnerability as a zero-day in late August 2026. During its investigation, Mandiant documented subsequent privilege escalation to root, persistence creation, attempts to obtain stored credentials, and log deletion.
BeyondTrust describes two known exploitation cases from August 29: one hosted instance and one self-hosted instance. This does not confirm widespread customer compromise, but it shows that the flaw was actively exploited before the fix was released.
GTIG/Mandiant assesses ARMORY CASTLE as a suspected actor linked to the People’s Republic of China. This is an analytical attribution by security researchers, not a legally proven attribution to the Chinese government.
Fix available; self-hosted appliances should be checked
BeyondTrust made the fix labeled BT26-05-RS available. Remote Support tenants in SaaS mode were fixed on October 9, 2026. Organizations operating their own appliances must check their systems and manually deploy the update if necessary.
For administrators, the priority is to identify all Remote Support deployments running version 26.2.3 or earlier, verify that the fix is installed, and review internet-accessible systems during the period of known exploitation. Relevant indicators include root-level escalation, persistence-related changes, attempts to access credentials, and unusual log deletion.
NHS England issued an alert on October 16 about active exploitation and said that further exploitation attempts are highly likely.
Privileged Remote Access status has not yet been confirmed
BeyondTrust is also addressing its Privileged Remote Access (PRA) product separately, which the company says shares relevant code. The vendor issued a preventive fix for PRA, but its internal testing has not yet confirmed that the flaw is exploitable in that product. Organizations using PRA should therefore monitor further technical information and the current status of BeyondTrust’s advisory.
Further developments could include CVE-2026-102764 being added to the U.S. CISA’s Known Exploited Vulnerabilities catalog, new indicators of compromise, or additional confirmed cases. It will also be important to see whether BeyondTrust publishes more detailed technical information about the attacks and whether its risk assessment for Privileged Remote Access changes.
Sources
- BeyondTrust BT26-05 – Confirms the CVE, severity, affected Remote Support versions, and availability of the fix.
- BeyondTrust: ARMORY CASTLE and BT26-05 – Confirms the incident timeline, limited number of known compromised instances, and the vendor’s position on PRA.
- Google Cloud / Mandiant: ARMORY CASTLE Exploits BeyondTrust – Documents the zero-day exploitation, attribution to the ARMORY CASTLE actor, privilege escalation, persistence, and credential risk.
- NHS England Digital alert CC-4870 – Independently warns of active exploitation, affected platforms, and the high likelihood of further exploitation.
Verified and updated: October 16, 2026, 15:19
