SecurityOnlineDo Son
Rapid7 details BeyondTrust flaw exploited for code execution
Part of the CVE-2026-102764 story · since 15 Oct
- Thu 15 Oct, 21:49 UTC. Google Cloud, first report. China Linked ARMORY CASTLE Exploited BeyondTrust Flaw as a Zero Day. Cites a CVE in CISA KEV.
- Fri 16 Oct, 07:56 UTC. The Hacker News, its first report on the story. China Linked Hackers Exploited BeyondTrust Zero Day to Steal Credentials. Cites a CVE in CISA KEV.
- Fri 16 Oct, 09:08 UTC. SecurityOnline, its first report on the story. BeyondTrust Patches Remote Access Flaw Exploited to Steal Credentials. Cites a CVE in CISA KEV.
- Fri 16 Oct, 10:22 UTC. Infosecurity, its first report on the story. China-Linked Hackers Exploited BeyondTrust Flaw to Install Root Backdoor. Cites a CVE in CISA KEV.
- Fri 16 Oct, 10:59 UTC. SecurityWeek, its first report on the story. Chinese APT exploited BeyondTrust Remote Support flaw to steal files. Cites a CVE in CISA KEV.
- Fri 16 Oct, 14:25 UTC. SOCRadar, its first report on the story. BeyondTrust Patches Zero-Day Flaw Used to Gain Root Access. Cites a CVE in CISA KEV.
- Fri 16 Oct, 19:02 UTC. CISA, its first report on the story. CISA Warns of Exploited BeyondTrust Remote Support Auth Bypass. Cites a CVE in CISA KEV.
- Fri 16 Oct, 20:58 UTC. Dark Reading, its first report on the story. China-linked hackers exploited BeyondTrust zero-day to steal credentials. Cites a CVE in CISA KEV.
- Sat 17 Oct, 12:00 UTC. Security Affairs, its first report on the story. CISA Flags Fortinet and BeyondTrust Flaws Under Active Attack. Cites a CVE in CISA KEV.
- Mon 19 Oct, 01:44 UTC. SecurityOnline. Actively Exploited Flaws Hit Cisco, BeyondTrust and WordPress Plugin. Cites a CVE in CISA KEV.
- Mon 19 Oct, 15:14 UTC. The Hacker News. Attackers Exploited BeyondTrust Zero Day as Crypto Wallets Were Backdoored. Cites a CVE in CISA KEV.
- Mon 19 Oct, 17:00 UTC. Rapid7, its first report on the story. BeyondTrust Remote Support flaw exploited before disclosure enabled file access. Cites a CVE in CISA KEV.
- Mon 2 Nov, 02:30 UTC. SecurityOnline. Rapid7 details BeyondTrust flaw exploited for code execution. Cites a CVE in CISA KEV. This article, 13th of 13.
Rapid7 has published a technical analysis and Metasploit module for CVE-2026-102764, a BeyondTrust Remote Support vulnerability that allows unauthenticated attackers to write files to an appliance and execute code as the site’s operating-system user. BeyondTrust confirmed two compromises on 29 August 2026, one involving a hosted instance and one a self-hosted appliance, before disclosing the flaw on 15 October.
Mandiant attributes the activity to ARMORY CASTLE, a suspected PRC-linked espionage actor previously tracked as UNC5221. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 16 October.
Rapid7 says the attack abuses a gap in origin validation between an internal message router and a customer-side worker. By placing a reserved local router ID in a message’s source address, an attacker can make the worker treat a remote request as local. Through the public connection used to start support sessions, the attacker can then reach an internal file-transfer service and control both a file’s contents and destination. Rapid7 demonstrated writing a PHP file into the web root; requesting it resulted in code execution. No credentials or user interaction are required.
Self-hosted Remote Support versions 26.2.3 and earlier are affected unless patched. BeyondTrust says its SaaS service was patched on 9 October 2026. The BT26-05-RS patch covers versions 24.3.1 through 26.2.3; older releases must first be upgraded to a supported version. Rapid7 tested version 24.1.2, but said it had not established the affected range or fixed builds through testing.
It advises checking for unexpected PHP files and reviewing appliance logs from late August onwards, noting that the Metasploit module deletes its PHP file before running its payload. BeyondTrust has not identified an exploit path in Privileged Remote Access, which shares affected code.
How the story developed
13 articles from 10 outlets since 15 Oct. Picked up again today after 13 days quiet. This was the 13th report, 17 days after the first.
- Thu 15 Oct, 21:49 UTC. Google Cloud, first report. China Linked ARMORY CASTLE Exploited BeyondTrust Flaw as a Zero Day. Cites a CVE in CISA KEV.
- Fri 16 Oct, 07:56 UTC. The Hacker News, its first report on the story. China Linked Hackers Exploited BeyondTrust Zero Day to Steal Credentials. Cites a CVE in CISA KEV.
- Fri 16 Oct, 09:08 UTC. SecurityOnline, its first report on the story. BeyondTrust Patches Remote Access Flaw Exploited to Steal Credentials. Cites a CVE in CISA KEV.
- Fri 16 Oct, 10:22 UTC. Infosecurity, its first report on the story. China-Linked Hackers Exploited BeyondTrust Flaw to Install Root Backdoor. Cites a CVE in CISA KEV.
- Fri 16 Oct, 10:59 UTC. SecurityWeek, its first report on the story. Chinese APT exploited BeyondTrust Remote Support flaw to steal files. Cites a CVE in CISA KEV.
- Fri 16 Oct, 14:25 UTC. SOCRadar, its first report on the story. BeyondTrust Patches Zero-Day Flaw Used to Gain Root Access. Cites a CVE in CISA KEV.
- Fri 16 Oct, 19:02 UTC. CISA, its first report on the story. CISA Warns of Exploited BeyondTrust Remote Support Auth Bypass. Cites a CVE in CISA KEV.
- Fri 16 Oct, 20:58 UTC. Dark Reading, its first report on the story. China-linked hackers exploited BeyondTrust zero-day to steal credentials. Cites a CVE in CISA KEV.
- Sat 17 Oct, 12:00 UTC. Security Affairs, its first report on the story. CISA Flags Fortinet and BeyondTrust Flaws Under Active Attack. Cites a CVE in CISA KEV.
- Mon 19 Oct, 01:44 UTC. SecurityOnline. Actively Exploited Flaws Hit Cisco, BeyondTrust and WordPress Plugin. Cites a CVE in CISA KEV.
- Mon 19 Oct, 15:14 UTC. The Hacker News. Attackers Exploited BeyondTrust Zero Day as Crypto Wallets Were Backdoored. Cites a CVE in CISA KEV.
- Mon 19 Oct, 17:00 UTC. Rapid7, its first report on the story. BeyondTrust Remote Support flaw exploited before disclosure enabled file access. Cites a CVE in CISA KEV.
- Mon 2 Nov, 02:30 UTC. SecurityOnline. Rapid7 details BeyondTrust flaw exploited for code execution. Cites a CVE in CISA KEV. This article, 13th of 13.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 13 articles as a listHide the list
- Thu 15 OctDay 01
- China Linked ARMORY CASTLE Exploited BeyondTrust Flaw as a Zero Day21:49 · Google Cloud · First report · Exploited CVE · Known exploited CVE
- Fri 16 OctDay 17
- China Linked Hackers Exploited BeyondTrust Zero Day to Steal Credentials07:56 · The Hacker News · Known exploited CVE
- BeyondTrust Patches Remote Access Flaw Exploited to Steal Credentials09:08 · SecurityOnline · Known exploited CVE
- CISA Warns of Exploited BeyondTrust Remote Support Auth Bypass19:02 · CISA · official · CISA alert · Known exploited CVE
Show 4 more from 16 Oct
- China-Linked Hackers Exploited BeyondTrust Flaw to Install Root Backdoor10:22 · Infosecurity · Known exploited CVE
- Chinese APT exploited BeyondTrust Remote Support flaw to steal files10:59 · SecurityWeek · Known exploited CVE
- China-linked hackers exploited BeyondTrust zero-day to steal credentials20:58 · Dark Reading · Known exploited CVE
- Sat 17 OctDay 21
- CISA Flags Fortinet and BeyondTrust Flaws Under Active Attack12:00 · Security Affairs · Known exploited CVE
Quiet for 2 days
Mon 19 OctDay 43- Actively Exploited Flaws Hit Cisco, BeyondTrust and WordPress Plugin01:44 · SecurityOnline · Known exploited CVE
- Attackers Exploited BeyondTrust Zero Day as Crypto Wallets Were Backdoored15:14 · The Hacker News · Known exploited CVE
- BeyondTrust Remote Support flaw exploited before disclosure enabled file access17:00 · Rapid7 · Known exploited CVE
Quiet for 13 days
Mon 2 NovDay 181- Rapid7 details BeyondTrust flaw exploited for code execution02:30 · SecurityOnline · Picked up again · Known exploited CVE · This article, 13th of 13