A critical zero-day vulnerability in BeyondTrust Remote Support is being actively exploited by a suspected nation-state threat actor. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, 2026, the day after BeyondTrust disclosed it. The flaw allows an unauthenticated attacker to perform arbitrary file operations on the appliance, and Mandiant reports that attackers are using it to harvest credentials, escalate privileges, and move laterally into downstream systems. If your organization or your IT provider uses BeyondTrust Remote Support, this post covers what happened, who is at risk, and what to do today.

This matters to small and mid-sized businesses in Canada and the US because remote support tools are how IT teams and managed service providers access and troubleshoot your systems. When that tool is compromised, the attacker inherits the same access your IT team has.

What Is CVE-2026-102764?

CVE-2026-102764 is an authentication bypass vulnerability in BeyondTrust Remote Support, rated critical with a CVSSv4 score of 9.3 according to BeyondTrust's security advisory BT26-05. The flaw exists in internal messaging components that did not adequately validate the origin of messages they received. Under the right conditions, this lets an unauthenticated remote attacker perform file operations on the appliance, including arbitrary uploads. The NVD entry for CVE-2026-102764 lists CWE-290 (Authentication Bypass by Spoofing) as the associated weakness.

Key facts from CISA, BeyondTrust, and the Canadian Centre for Cyber Security:

  • Affected versions: All BeyondTrust Remote Support versions 26.2.3 and earlier.
  • Severity: CVSSv4 9.3 (Critical), per BeyondTrust advisory BT26-05.
  • KEV listing: CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities catalog on October 16, 2026.
  • CCCS alert: The Canadian Centre for Cyber Security issued AL26-025 on October 16, 2026.
  • Patch: BT26-05-RS patch available for self-hosted versions 24.3.1 through 26.2.3. SaaS customers were automatically patched on October 9, 2026.

Who Is Exploiting This and How?

Mandiant published detailed research on October 15, 2026, attributing the exploitation to ARMORY CASTLE, a suspected China-nexus espionage threat actor formerly tracked as UNC5221. According to Mandiant, ARMORY CASTLE exploited CVE-2026-102764 as a zero-day starting in late August 2026, before BeyondTrust knew the vulnerability existed. The actor demonstrated deep familiarity with BeyondTrust appliance internals, abusing proprietary CLI utilities and startup configuration templates to maintain persistent access.

Mandiant observed the following post-exploitation activity:

  1. Webshell deployment: The actor deployed a custom PHP webshell called SAWFLY that uses encrypted communications and returns HTTP 404 errors to evade detection.
  2. Privilege escalation: The attacker exploited SUID bit permissions to gain root access from the web service account.
  3. Credential harvesting: The actor used BeyondTrust's built-in credential vault CLI to extract stored passwords, API keys, and endpoint credentials.
  4. Persistence: Boot scripts were modified to grant passwordless sudo access that survives reboots and configuration resets.
  5. Lateral movement: The attacker used the Remote Support application to launch sessions to downstream systems and exfiltrate documents.
  6. Log deletion: Throughout the intrusion, the actor deleted system and application logs to evade detection.

This is a sophisticated, targeted operation. However, Mandiant warns that ARMORY CASTLE has historically conducted widespread exploitation after vulnerabilities go public, racing to compromise organizations before patches are applied.

Who Is at Risk?

Any organization running a self-hosted BeyondTrust Remote Support appliance on version 26.2.3 or earlier. This includes businesses across Canada and the United States that use Remote Support for internal IT operations, as well as managed service providers (MSPs) that use it to support multiple clients. A compromised MSP appliance could expose credentials and access paths for every downstream business it supports.

The risk is not limited to direct BeyondTrust customers. If your IT provider uses BeyondTrust Remote Support to manage your systems, their compromise becomes your exposure. This is not a theoretical concern: we covered another case just days ago where attackers targeted AhsayCBS backup servers used by MSPs, planting webshells on management consoles that connect to multiple client environments. The CISA advisory specifically notes that attackers are "establishing persistence, escalating privileges, and moving laterally" after gaining initial access.

BeyondTrust SaaS customers were automatically patched on October 9, 2026, according to the vendor advisory. No customer action is required for the appliance itself if you use the hosted version, though credential rotation is still recommended if the appliance was exposed during the window.

Why Remote Support Tools Are High-Value Targets

Remote support tools sit at a privileged intersection. They are designed to let IT teams access endpoints across the organization, often with administrative credentials. They store or broker credentials for downstream systems. And they are typically reachable from the internet so remote technicians can connect. All of these properties make them attractive targets.

This is not the first time edge and remote-access appliances have been targeted by ARMORY CASTLE. The actor, formerly tracked as UNC5221, has a history of exploiting remote-access products: Mandiant and Google Threat Intelligence Group previously attributed zero-day exploitation of Ivanti Connect Secure flaws CVE-2023-46805 and CVE-2024-21887, as well as Citrix NetScaler CVE-2023-4966 (Citrix Bleed), to the same group. The pattern is the same: a device that is exposed by design becomes a beachhead into the broader network. We covered a separate Ivanti Connect Secure zero-day (CVE-2026-104935) just days ago; that flaw has not been attributed to ARMORY CASTLE.

For small businesses, the concern is less about being specifically targeted by a nation-state actor and more about the opportunistic exploitation that follows public disclosure. Once exploit code is available, less sophisticated attackers use it against anyone who has not patched.

What Should You Do If You Run BeyondTrust Remote Support?

Apply the BT26-05-RS patch immediately. Recommended actions from CISA, BeyondTrust and Mandiant:

  1. Patch self-hosted appliances: Apply the BT26-05-RS patch from the /appliance interface. If your instance is older than version 24.3.1, upgrade to a supported version first.
  2. Restrict administrative access: Limit external access to the /login and /appliance administrative interfaces to trusted networks. Only representative console, customer portal, and Jump Client traffic should be reachable from the internet.
  3. Investigate for compromise: If your appliance was reachable from the internet while vulnerable, treat it as potentially compromised. Look for unauthorized session activity, unrecognized scripts in web directories, unexpected permission changes, and gaps in logs or log forwarding.

If you find evidence of compromise or cannot rule it out, CISA recommends rebuilding the appliance from a known-good state rather than attempting to clean it. Host-level persistence survives reboot and configuration reset. After rebuilding:

  • Rotate every credential the appliance stored or injected, including API keys, certificates, and brokered passwords.
  • Revoke all active support sessions.
  • Review new multifactor authentication registrations on privileged accounts.
  • Redeploy Jump Clients and Jumpoints from the rebuilt appliance.

What Should SMB Leaders Ask Their IT Provider?

If an MSP or internal IT team manages your systems, ask these questions this week:

  1. Do you use BeyondTrust Remote Support (or Bomgar) to access our systems? If yes, which version, and has the BT26-05-RS patch been applied?
  2. If you use SaaS, have you confirmed that BeyondTrust patched your instance on October 9?
  3. If the appliance was exposed before the patch, are you investigating for compromise? CISA recommends checking for unauthorized sessions, log gaps, and unexpected file changes.
  4. What credentials pass through or are stored on your Remote Support appliance? If it was compromised, those credentials need to be rotated.
  5. Do you have a forensic preservation plan? Mandiant notes that attackers delete logs to cover their tracks. If your provider rebooted or wiped the appliance before preserving evidence, it may be too late to know what happened.

The one question to ask before patching day ends: "If your Remote Support appliance was compromised last month, how would we know, and what credentials of ours would be at risk?"

The Broader Pattern

This is not the only critical remote-access flaw this month. We covered the Ivanti Connect Secure zero-day on October 14, and the SonicWall SMA1000 vulnerability on October 11. Different vendors, same lesson: the tools that let your team work remotely are also the tools attackers check first.

Remote-access appliances need to be treated as high-risk assets. That means prompt patching, restricted administrative access, continuous log monitoring, and a plan for forensic investigation when a severe flaw is disclosed. For businesses that rely on a managed service provider, it also means understanding what tools your provider uses to access your systems and what their patch and incident response practices look like.

If you are unsure where your organization stands, start with our free quick security assessment. It takes about five minutes and highlights which of 22 security areas need attention.

This article is intended for general informational purposes only and does not constitute professional security, legal, or compliance advice. Details about CVE-2026-102764 are based on public disclosures from CISA, BeyondTrust, the Canadian Centre for Cyber Security, and Mandiant as of October 17, 2026, and may evolve as investigations continue. Organizations should consult qualified cybersecurity professionals before acting on any specific indicator of compromise or making operational changes based on this article.