BeyondTrust Remote Support zero-day exploited in ARMORY CASTLE intrusions

BeyondTrust disclosed CVE-2026-102764 on October 15 as a critical flaw in its Remote Support product. The company’s advisory describes improper origin validation in an internal messaging component. Under the right conditions, the flaw could let a remote attacker perform file operations on an affected appliance. BeyondTrust has withheld further technical details while self-hosted customers patch. (BeyondTrust advisory BT26-05; BeyondTrust response)

CISA's Known Exploited Vulnerabilities catalog lists CVE-2026-102764 with an October 19, 2026 remediation deadline for Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04. The deadline applies to those federal agencies; it is not a general private-sector legal requirement. For self-hosted Remote Support customers, BeyondTrust's patch guidance remains the direct remediation path. (CISA alert on BeyondTrust Remote Support; CISA Binding Operational Directive 26-04)

The advisory lists all Remote Support versions through 26.2.3 as affected. It provides the BT26-05-RS patch for versions 24.3.1 through 26.2.3; installations older than 24.3.1 need to upgrade before applying the patch. The advisory says the patch had been applied to all Remote Support SaaS customers by October 9. Self-hosted customers should apply it through the appliance interface or confirm that automatic updates installed it. (BeyondTrust advisory BT26-05)

BeyondTrust’s timeline says the zero-day was exploited on August 29 against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. Mandiant’s investigation found evidence of exploitation in a separate incident response engagement. Google Threat Intelligence Group and Mandiant identify the activity as ARMORY CASTLE, formerly tracked as UNC5221, and describe the actor as suspected PRC-nexus. BeyondTrust says its attribution assessment has moderate-to-high confidence. (BeyondTrust response; Google Cloud and Mandiant report)

Mandiant describes post-exploitation activity that included a web shell, privilege escalation, credential theft, persistence and log deletion. It recommends treating vulnerable appliances that were internet-reachable during the exploitation window as potentially compromised until they have been reviewed. BeyondTrust recommends forwarding appliance logs off-device and hunting for attacker behavior, since local logs may be altered or removed. (Google Cloud and Mandiant report; BeyondTrust response)

BeyondTrust says it also released a patch for Privileged Remote Access (PRA) because it shares affected code. The company says its internal testing did not identify an exploit path for PRA. The confirmed vulnerability and exploitation described in the advisory and incident reports concern Remote Support. (BeyondTrust response)

The incident also surfaced an alert-handling gap. BeyondTrust says its sensors generated alerts during the activity, but a built-in triage tool in a third-party detection platform closed them as false positives. Its response post recommends keeping triage-closed alerts in hunt scope and running threat-informed hunts independently of alert verdicts. BeyondTrust describes the tool as automated triage; its post does not say that a language model or AI system made the decision. (BeyondTrust response)