# BeyondTrust Remote Support zero-day was exploited for about seven weeks before disclosure

CVE-2026-102764, an authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier, was exploited before a fix existed. Patch, then check for compromise.

By Synt World. Published: 2026-10-19T12:27:14+00:00. Updated: 2026-10-19T12:27:14+00:00.

## At a glance

- **Bottom line:** Self-hosted BeyondTrust Remote Support appliances on 26.2.3 or earlier need the BT26-05-RS patch and a compromise check: the flaw was exploited for a month before the vendor identified it.
- **Affected:** BeyondTrust Remote Support (formerly Bomgar) 26.2.3 and earlier. BeyondTrust patched its hosted (SaaS) tenants on October 9, 2026, according to Google Threat Intelligence Group.
- **Exploitation:** CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, 2026. Google Threat Intelligence Group attributes the zero-day exploitation to a suspected PRC-nexus espionage actor it tracks as ARMORY CASTLE.

## What happened

On October 16, 2026, CISA warned that threat actors are actively exploiting CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support, and added it to the Known Exploited Vulnerabilities (KEV) catalog. According to CISA, attackers use the flaw for initial access, then establish persistence, escalate privileges and move laterally.

Mandiant and Google Threat Intelligence Group (GTIG) found the activity during incident response. GTIG attributes it to ARMORY CASTLE, a suspected PRC-nexus espionage actor it previously tracked as UNC5221, and dates the first exploitation it observed to late August 2026. SecurityWeek, reporting on the same research, gives August 29 as the start of exploitation and says the first attacks hit one BeyondTrust-hosted and one self-hosted appliance. BeyondTrust identified the defect on September 28 and shipped a patch on October 8, according to SecurityWeek; GTIG gives October 15 as the disclosure date.

## Seven weeks of exposure

- 2026-08-29: First observed exploitation (SecurityWeek; GTIG says late August).
- 2026-09-28: BeyondTrust identifies the flaw (SecurityWeek).
- 2026-10-08: BT26-05-RS patch released (SecurityWeek).
- 2026-10-09: BeyondTrust applies the patch to SaaS tenants (GTIG).
- 2026-10-15: Public disclosure (GTIG).
- 2026-10-16: CISA alert and KEV listing (CISA).

![Bar chart: days after the first observed exploitation on 2026-08-29. Vendor aware: 30. Patch released: 40. SaaS tenants patched: 41. Public disclosure: 47. Added to CISA KEV: 48.](/assets/insights/beyondtrust-remote-support-zero-day-1.svg)

Defenders who waited for the public advisory started about seven weeks after the attackers. Day 0 is August 29, the date SecurityWeek reports; GTIG says late August.

## What the attackers did after getting in

GTIG and SecurityWeek describe the same pattern after access: web shells and root-level persistence on the appliance, deletion of appliance and syslog records, a dump of the appliance's credential vault, and then stolen administrator credentials used to open remote support sessions to internal machines and take documents. GTIG's report lists the file paths and indicators; use it for hunting rather than this summary.

## Who is affected

Self-hosted Remote Support appliances on version 26.2.3 or earlier. The BT26-05-RS patch covers versions 24.3.1 through 26.2.3, according to SecurityWeek; the sources cited here list no patch for older releases. BeyondTrust patched hosted (SaaS) tenants itself on October 9, according to GTIG. The sources cited here discuss Remote Support only; if you run BeyondTrust Privileged Remote Access, check the vendor advisory for that product.

SecurityWeek reports a CVSS score of 9.3. FIRST's EPSS model gave the CVE a 1.2% probability of exploitation activity in the next 30 days on October 19, 2026. That low number sits next to confirmed in-the-wild exploitation: EPSS estimates future attempts across the internet and lags behind incident-response findings like this one, so for this CVE the KEV listing is the signal to act on.

## Check and close the gap

- Apply the BT26-05-RS patch from BeyondTrust advisory BT26-05 to every self-hosted appliance (CISA).
- If you cannot patch at once, isolate the appliance at the perimeter firewall, end active sessions and disable Jump Clients, Jumpoints and API accounts (GTIG).
- Treat an appliance that was reachable from the internet since late August as possibly compromised: investigate, and rebuild from a known-good, patched image if you find signs of compromise (CISA, GTIG).
- After patching or rebuilding, rotate every credential stored on or used by the appliance: appliance administrators, /login users, API secrets and vault credentials (GTIG).
- Require SSO with phishing-resistant MFA for /login users, enable MFA on the built-in administrator account and restrict the administrative interface to known networks (GTIG).
- Forward appliance syslog to your SIEM over TLS and alert on gaps, since log deletion was part of this intrusion (GTIG).
- Hunt for role changes that raise Jump Item or team roles to Administrator, successful logins from residential or commercial VPN address space, and file transfers by accounts whose roles changed (GTIG).
- Limit external access to the appliance to the services needed to support users and customers (CISA).

## Why remote support tools are worth this effort to attackers

A remote support appliance sits at the network edge, stores credentials and can open sessions into internal machines. An authentication bypass there is worth more to an attacker than the score suggests: in this intrusion the appliance's own credential vault and session features carried the lateral movement. For teams that run web applications and APIs, the practical lesson is to keep an inventory of internet-facing administrative tools, keep them off the open internet where the business allows, and plan for the window before a patch exists. Patching closes the hole; only an investigation tells you whether someone used it first.

## Sources

- [CISA: CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support (October 16, 2026)](https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support)
- [CISA Known Exploited Vulnerabilities catalog: CVE-2026-102764](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764)
- [BeyondTrust Security Advisory BT26-05](https://www.beyondtrust.com/trust-center/security-advisories/bt26-05)
- [Google Threat Intelligence Group: ARMORY CASTLE Exploits BeyondTrust](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust)
- [SecurityWeek: Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day](https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/)
- [FIRST EPSS](https://www.first.org/epss): EPSS scores from FIRST — see EPSS at https://www.first.org/epss