BeyondTrust Patches a Critical Remote Support Zero-Day That Attackers Exploited From 29 August

BeyondTrust has fixed a critical vulnerability in its Remote Support software that a suspected China-linked espionage group exploited as a zero-day, before any patch existed, from 29 August 2026. Customers using BeyondTrust’s cloud service have already been patched. Organisations running their own Remote Support appliances need to apply the fix now and check whether they were compromised.

The flaw, tracked as CVE-2026-102764, was disclosed on 15 October in BeyondTrust security advisory BT26-05, together with a BeyondTrust blog post and an analysis by Google’s Mandiant.

What is affected

Remote Support, formerly known as Bomgar, lets IT and help-desk teams connect to and fix computers remotely. Because it stores and hands out privileged credentials, it is a valuable target.

According to the advisory:

• Severity: CVSSv4 score of 9.3, rated Critical.
• Product: Remote Support, all versions up to and including 26.2.3.
• Fix: the BT26-05-RS patch, for versions 24.3.1 to 26.2.3.
• The bug: “improper origin validation in an internal messaging component”, meaning internal parts of the software did not properly check where messages came from. Under the right conditions, BeyondTrust says, that could let a remote attacker “perform file operations on the appliance.”

Mandiant says the flaw can be exploited by an unauthenticated attacker, with no login, and that it “can lead to host-level control and access to every credential the appliance stores or brokers.”

BeyondTrust is withholding further technical details while self-hosted appliances are still being patched, and TSN is not publishing exploit details either.

What about Privileged Remote Access?

BeyondTrust’s Privileged Remote Access (PRA) product shares the affected code. The company says its internal testing “has not identified any way for an attacker to exploit this vulnerability” in PRA, but it has released a patch for PRA “out of an abundance of caution” and recommends that self-hosted PRA customers apply it immediately.

What to do now

If you use BeyondTrust’s cloud (SaaS) service: the patch was applied automatically on 8–9 October; BeyondTrust’s advisory gives 9 October and its blog 8 October. BeyondTrust says no further action is needed for the service itself. Mandiant adds that the credential and configuration checks below still apply.

If you run your own Remote Support appliance:

1. Patch. On version 24.3.1 or later, apply BT26-05-RS from the /appliance interface, or confirm it installed automatically if you subscribe to automatic updates. On a version older than 24.3.1, upgrade to a supported version first, then patch. Mandiant notes that upgrading closes the hole but does not undo any earlier compromise.
2. Patch PRA too, if you run a self-hosted PRA appliance.
3. Assume exposure if you were online. Mandiant says any appliance reachable from the internet on a vulnerable version during the exploitation window “should be treated as potentially compromised until it has been reviewed.”
4. Get logs off the box. BeyondTrust says the attackers delete local logs, so forward appliance logs to a central security system, where off-box copies may be the only record.
5. Restrict access. Limit the administrative interfaces to trusted networks and allow only the outbound traffic the appliance needs.
6. Hunt for suspicious behaviour, such as unexplained administrator sessions from home broadband or commercial VPN addresses, unexpected permission changes and gaps in log forwarding.
7. If you find anything, rotate credentials. BeyondTrust says to treat every credential the appliance stored or injected as exposed. Mandiant advises rotating only after the appliance is patched or rebuilt, and rebuilding suspected appliances from a clean image rather than trying to clean them.

Customers who suspect exploitation can open a Sev 1 support request citing “BT26-05”, BeyondTrust says.

How it was found

BeyondTrust says the attacker hit one BeyondTrust-hosted Remote Support instance and one self-hosted appliance on 29 August. Its threat-hunting team spotted the activity on 28 September and contained the hosted instance within 27 minutes. Mandiant, investigating the self-hosted customer, confirmed the findings on 30 September. The fix shipped on 8 October, and the coordinated disclosure followed on 15 October.

BeyondTrust also says its sensors had fired when the attacker escalated privileges, but an automated triage tool in its third-party detection platform closed those alerts as false positives. It is working with that vendor on the problem.

Who is behind it

Google Threat Intelligence Group and Mandiant attribute the exploitation to ARMORY CASTLE, a suspected China-nexus espionage actor formerly tracked as UNC5221. BeyondTrust says it shares that assessment with “moderate to high confidence”, and that CrowdStrike tracks the same cluster as WARP PANDA. These are the companies’ assessments, not findings by any government.

Mandiant says the group has previously exploited zero-days in Citrix NetScaler and Ivanti Connect Secure, and warns that it may now move to “widespread exploitation” of unpatched appliances, as it did after earlier disclosures.

What’s still unknown

BeyondTrust has not said how many customers were affected beyond the two instances in August, or what data, if any, was taken.

What to watch

Watch for signs of mass exploitation now the flaw is public, and for government advisories adding it to must-patch lists.

What this means

• Patch self-hosted appliances now. SaaS is done; self-hosted Remote Support and PRA are not.
• Patching is not enough. Exposed appliances should be reviewed for compromise.
• Expect more attacks. Mandiant warns that broad exploitation may follow disclosure.

Sources

1. BeyondTrust, Security Advisory BT26-05, 15 October 2026
2. BeyondTrust, “ARMORY CASTLE and BT26-05: What Security Teams Need to Know”, 15 October 2026
3. Mandiant / Google Threat Intelligence Group, “ARMORY CASTLE Exploits BeyondTrust”, Google Cloud blog, 15 October 2026

Related stories

• Palo Alto Networks Says a PAN-OS Flaw Is Being Exploited, and CISA Adds It to Its Must-Patch List
• Cisco Patches a Secure Email Gateway Zero-Day That Attackers Are Already Using
• Attackers Used a Critical Flaw in Collabora’s Built-in CODE App to Plant Web Shells on Nextcloud Servers