Table of contents
18
Read this in 30 seconds: CVE-2026-102764 is a critical authentication bypass in BeyondTrust Remote Support, exploited as a zero-day since August 29, 2026, by an actor BeyondTrust assesses with moderate to high confidence is the China-nexus group Mandiant tracks as UNC5221 (now “ARMORY CASTLE”). CISA added it to the Known Exploited Vulnerabilities catalog on October 16, 2026, with a due date of October 19 and a forensic-triage flag.
- The attacker’s own detector missed it first. BeyondTrust’s sensors fired in real time, but its third-party detection platform’s automated triage closed the alert as a false positive; a separate proactive threat hunt caught it a day later.
- This is the same actor’s fourth known edge-appliance zero-day. Mandiant and GTIG have publicly attributed UNC5221 zero-days against Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, then CVE-2025-0282).
- Containment was fast once found. BeyondTrust’s Cyber Defense team detected the compromised SaaS instance and contained it within 27 minutes, then reproduced the entry vector in a lab about seven hours later.
- The scope is narrow but the versions are wide. CVE-2026-102764 affects every Remote Support build up to 26.2.3, and BeyondTrust patched Privileged Remote Access too, out of caution, since it shares the vulnerable code, though internal testing found no way to exploit PRA specifically.
- BeyondTrust is withholding the technical mechanism. The company says publishing it now, while self-hosted appliances are still patching, “would place customers at an increased risk level.”
A remote-support appliance is built to be trusted by everything it touches, which is exactly what made CVE-2026-102764 worth a nation-state actor’s zero-day.
BeyondTrust Remote Support and Privileged Remote Access appliances broker privileged sessions and store the credentials that let a help desk or an administrator reach systems across an entire estate. CVE-2026-102764 let an unauthenticated remote attacker perform file operations on that appliance by spoofing the origin of internal messages, CWE-290 in its textbook form.
This article covers what BeyondTrust’s advisory and incident write-up say about CVE-2026-102764, who BeyondTrust assesses exploited it and why that attribution matters, the detection failure worth learning from, which versions are actually affected, and what to hunt for given that the technical mechanism itself has not been published.
A BeyondTrust Remote Support appliance sits in the middle of an organization’s privileged access, not at its edge. Help desk staff use it to take control of a user’s machine; administrators use its sibling product, Privileged Remote Access, to reach servers and network gear without handing out standing credentials.
That means the appliance itself stores or brokers the secrets needed to reach everything downstream of it. BeyondTrust’s own incident write-up confirms the actor went after exactly that: “the actor reads the appliance’s stored secrets and uses administrative access in the application to reach downstream systems.” A compromised remote-support appliance is not one compromised box. It is a credential source and a map of who connects to what.
BeyondTrust’s security advisory BT26-05 describes it in one line: “the components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.”
The facts, straight from the advisory and NVD:
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scored by NVD itself as the primary source. BeyondTrust’s own CVSS 4.0 score is 9.3 (Critical).BeyondTrust is explicit about what it is not publishing yet: “we are withholding the technical details of the vulnerability. Publishing such details while self-hosted appliances are still being patched would place customers at an increased risk level.” That is a deliberate, stated choice, not a gap in reporting, and it is why this article has no exploit mechanism section. There is nothing published to reconstruct.
BeyondTrust assesses “with moderate to high confidence” that the actor behind this zero-day is the group Google Threat Intelligence Group (GTIG) and Mandiant track as UNC5221, which Mandiant has renamed ARMORY CASTLE. CrowdStrike tracks what it believes is the same cluster as WARP PANDA. BeyondTrust describes the assessment as resting on tradecraft rather than static indicators, since the actor rotates its infrastructure for every victim.
This is not this actor’s first edge-appliance zero-day, if the attribution holds. Per BeyondTrust’s own post, Mandiant and GTIG have publicly attributed to UNC5221 the zero-day exploitation of Citrix NetScaler (CVE-2023-4966, “Citrix Bleed”) and of Ivanti Connect Secure (CVE-2023-46805 and CVE-2024-21887, then later CVE-2025-0282). BeyondTrust also says that in 2025, Mandiant reported this actor took an Ivanti patch for a flaw rated low risk, studied it, and turned it into working remote code execution against appliances that had not patched it yet, which is a meaningfully different threat model than “patch within your SLA.”
BeyondTrust’s own read on the actor’s tradecraft is worth stating plainly, with the caveat that it is their assessment, not confirmed forensics: “We do not have forensic proof of the use of such AI-enabled tooling, but we recommend that defenders plan as though this assessment is accurate,” referring to GTIG’s broader finding that exploited-vulnerability counts nearly doubled in 2026 and that GTIG documented the first known zero-day exploit script built with generative AI.
| Date | Event |
|---|---|
| Aug 29, 2026 | Actor exploits the zero-day against one BeyondTrust-hosted and one self-hosted Remote Support instance |
| Sep 27, 2026 | A separate vendor’s zero-day campaign against edge appliances becomes public; BeyondTrust’s threat intel pipeline queues a hunt |
| Sep 28, 2026 | The hunt surfaces the compromised SaaS instance; BeyondTrust contains it within 27 minutes of detection |
| Sep 28, 2026 (later) | Product Security reproduces the entry vector in a lab roughly 7 hours after containment; Engineering starts a fix |
| Sep 30, 2026 | Mandiant independently confirms the same finding from the self-hosted customer |
| Oct 8, 2026 | BeyondTrust ships the BT26-05 patch for all supported versions |
| Oct 9, 2026 | Patch confirmed applied to all SaaS customers |
| Oct 15, 2026 | Coordinated disclosure: the CVE, the public advisory, BeyondTrust’s blog post and Mandiant’s analysis all publish together |
| Oct 16, 2026 | CISA adds CVE-2026-102764 to the KEV catalog, forensic triage required, due Oct 19 |
Two things stand out in that sequence. BeyondTrust did not find this because of CVE-2026-102764 itself; it found it because a different vendor’s breach going public triggered a proactive hunt for similar tradecraft. And the gap between the actor’s last confirmed use (August 29) and detection (September 28) is a full month, which the company attributes to the actor’s selective, low-and-slow use of the zero-day against a small number of targets before public exploitation typically broadens.
Per BeyondTrust’s own investigation, corroborated by Mandiant’s parallel analysis of the self-hosted victim, the post-exploitation pattern had five parts:
Mandiant’s own publication includes file hashes and YARA rules for the actor’s web shell and tunneling tool; we have not reproduced specific indicators here since we did not independently verify them, and BeyondTrust itself notes that indicators from one victim “rarely reappear at the next.”
This is the part of BeyondTrust’s CVE-2026-102764 write-up that applies to almost every security team reading it, independent of whether you run this product. BeyondTrust’s own sensors fired in real time when the actor escalated privileges. The built-in triage layer in BeyondTrust’s third-party detection platform closed those alerts as false positives, and the actual detection came a day later, from a separate, proactive threat-hunting pipeline that does not depend on a vendor’s alert verdict.
BeyondTrust’s stated response is to work with that detection vendor so automated triage “cannot close high-severity signals independently,” and to use its own hunting tooling to reverify external dispositions before trusting them closed. Their own framing of the lesson: “Treat a triage verdict as one input and keep the alerts it closes in scope for your hunts,” and run a hunting program that starts from threat intelligence rather than waiting on an alert to fire.
You are in the affected population if you run a self-hosted Remote Support appliance on version 26.2.3 or earlier, which is every version before the BT26-05 patch.
Privileged Remote Access is a separate question. BeyondTrust states plainly that internal testing “has not identified any way for an attacker to exploit this vulnerability in Privileged Remote Access,” but PRA shares the affected code with Remote Support, so BeyondTrust released and recommends the patch for self-hosted PRA anyway, “out of an abundance of caution.” Treat that as a precautionary patch, not a confirmed second affected product; NVD’s affected-products list for CVE-2026-102764 names only Remote Support.
SaaS customers of both products do not need to take any patching action. BeyondTrust confirms SaaS instances were automatically patched by October 9, 2026.
/appliance interface.
Because this actor rotates infrastructure per victim, BeyondTrust’s own guidance is to hunt for behavior rather than static indicators. Their published list:
# Illustrative only: searching forwarded appliance syslog in a SIEM for the gap pattern
# described above. Adapt field names to your own log schema; this is not a BeyondTrust
# product command, since no exploitation mechanism has been published to script against.
grep -E "bt-remote-support" siem_export.log \
| awk '{print $1, $2, $NF}' \
| sort \
| uniq -c \
| awk '$1 == 1 {print "possible forwarding gap near:", $2, $3}'That script is a generic log-gap finder we wrote for this article, not anything BeyondTrust published. Use it as a starting point against your own SIEM schema, not as a verified detection.
So yeah, here is the part where we talk about our own angle, clearly marked as that.
What stands out about this case from a testing perspective is the detection failure, not the vulnerability class. CVE-2026-102764 is a straightforward CWE-290, but the thing that actually let the actor operate for a month was a trusted alert verdict nobody re-checked. XHack’s AI VAPT services test the authentication and session-handling surface of appliances like this directly, unauthenticated included, and our agent treats a vendor’s own alert closure the same way BeyondTrust now says it should be treated: as one input, not a verdict.
We are not BeyondTrust’s detection vendor, and we are not claiming XHack would have caught this specific actor. What we can say honestly is that the behavioral hunt BeyondTrust describes, like sessions from unexplained VPN exits and gaps in log forwarding, is exactly the kind of pattern our platform’s continuous monitoring is built to flag for review rather than silently close. If you want that tested against your own BeyondTrust deployment or any other remote-access appliance, book a consultation, even if the honest answer turns out to be that your existing stack already covers it.
CVE-2026-102764 is a critical authentication bypass by spoofing (CWE-290) in BeyondTrust Remote Support. An internal messaging component did not validate the origin of messages it received, which under the right conditions let a remote attacker perform file operations on the appliance. BeyondTrust has not published the exact technical mechanism.
Yes, confirmed directly by BeyondTrust. The company says a China-nexus actor it assesses with moderate to high confidence is UNC5221 (Mandiant’s “ARMORY CASTLE”) used it as a zero-day starting August 29, 2026, against one BeyondTrust-hosted and one self-hosted Remote Support instance, before the public disclosure on October 15.
Remote Support versions 26.2.3 and below are confirmed affected. Privileged Remote Access shares the vulnerable code and BeyondTrust patched it as a precaution, but internal testing found no way to exploit PRA specifically, and NVD’s affected-products record lists only Remote Support.
SaaS customers of Remote Support and Privileged Remote Access were automatically patched by October 9, 2026, and need to do nothing. Self-hosted customers should apply the BT26-05 patch through their appliance’s update mechanism; anyone on Remote Support older than version 24.3.1 needs to upgrade first, since the patch only covers the 24.3.1 to 26.2.3 range.
BeyondTrust’s own Cyber Defense team found it, not an external researcher or bug bounty submission. A proactive threat hunt triggered by a different vendor’s zero-day campaign becoming public on September 27, 2026, surfaced the compromised instance the next day.
Confirmed active exploitation by a sophisticated actor against a privileged-access appliance meets CISA’s bar for both the KEV catalog and the stricter BOD 26-04 forensic-triage requirement, which asks agencies to preserve evidence rather than just patch and move on, since the actor is documented to delete local logs.
CVE-2026-102764 is a reminder that the appliance protecting your privileged access is itself a target worth a nation-state’s zero-day, and that detection tooling closing an alert is not the same as the alert being wrong. BeyondTrust’s own account of a hunting program catching what an automated triage layer dismissed is the most useful takeaway here, whether or not you run this specific product.
If you self-host Remote Support or Privileged Remote Access, patch to BT26-05 now, confirm your logs are actually leaving the appliance, and hunt for the behavioral pattern above rather than waiting on indicators that this actor is known to rotate away from.
Categories
Related articles
