BEYONDTRUST disclosed CVE-2026-102764, a critical improper origin validation vulnerability (CWE-290) in its internal Remote Support messaging component. The flaw allowed remote attackers to trigger file operations without authentication or user interaction under certain conditions, potentially achieving root access after initial exploitation. BeyondTrust assigns a CVSS v4.0 score of 9.3 and notes that the vulnerability was exploited as a zero-day before customers could apply a patch.
Two BeyondTrust deployments were affected on 29 August 2026—a BeyondTrust-hosted Remote Support instance and a self-hosted appliance. The activity was detected during proactive hunting on 28 September, with the entry vector reproduced the same day. A patch, BT26-05-RS, was released on 8 October and publicly disclosed on 15 October. The incident attribution points to ARMORY CASTLE (formerly UNC5221), a suspected PRC-nexus espionage actor known for targeting edge appliances.
The attackers progressed from the initial file upload to root-level execution, attempted to retrieve credentials via BeyondTrust’s bt-secrets utility, modified startup configurations for persistent privileged access, accessed the Remote Support portal with compromised administrator credentials, and deployed BARECLAW, a SOCKS5-over-WebSocket tunnel, alongside HAProxy configuration changes to extend reach within downstream systems.
While GTIG and Mandiant note that widespread exploitation had not been confirmed as of 15 October, the advisory urges immediate patching and comprehensive off-appliance evidence preservation.