A China-Linked Zero-Day in BeyondTrust Remote Support Lands on CISA's Known Exploited Vulnerabilities Catalog

What happened?

CISA added CVE-2026-102764, which its catalog calls the “BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability”, to its Known Exploited Vulnerabilities catalog on 16 October 2026. The entry sets a required-action date of 19 October 2026 for US federal civilian agencies. It tells them to apply the vendor’s mitigations, follow Binding Operational Directive 26-04 and its forensic-triage requirements, check each appliance’s internet exposure, and stop using the product if no mitigation is available.

BeyondTrust Remote Support is an appliance that IT and support teams use to connect to people’s devices. BeyondTrust’s advisory, BT26-05, was issued on 15 October 2026 and rates the flaw 9.3 (critical) under CVSS 4.0. The Canadian Centre for Cyber Security’s alert, issued the next day, says the flaw lies in insufficient origin validation in the product’s internal messaging components. It lets a remote attacker, with no credentials and no user action, perform file operations on the appliance, including uploading arbitrary files, which can lead to full compromise.

How was it found?

As an attack, not a bug report. Google’s Threat Intelligence Group (GTIG), working with Mandiant, published its analysis on 16 October 2026. It says the flaw was exploited as a zero-day from late August 2026, weeks before a fix existed. BeyondTrust patched all its cloud (SaaS) Remote Support and Privileged Remote Access customers on 9 October, before publishing the advisory on 15 October. CISA’s KEV listing followed a day later.

Who’s behind it?

GTIG attributes the activity to a suspected China-nexus espionage actor it tracks as ARMORY CASTLE, previously known as UNC5221, which it has reported on since at least October 2023. According to GTIG, the actor:

• planted an obfuscated PHP webshell it calls SAWFLY, and a tunnelling tool it calls BARECLAW;
• turned a copy of the system shell into a root-level backdoor and added a sudoers entry that survives reboots;
• used the appliance’s own tools to dump its credential vault;
• deleted appliance, web server and application logs throughout, to hinder investigation.

Why does it matter?

Internet-facing appliances used for remote or privileged access are a favoured way into a network, because one foothold there can open everything behind it. This case also shows why CISA now asks for forensic triage rather than only a patch: an appliance can be fully patched today and still be compromised from the weeks it was exposed. With logs deleted on the device, the evidence may only exist in copies kept elsewhere.

What should you do?

If you run self-hosted BeyondTrust Remote Support, apply the BT26-05-RS patch. The Canadian Cyber Centre’s alert says it covers versions 24.3.1 to 26.2.3, and older installations must first be upgraded to a supported version. Cloud customers were patched by BeyondTrust and need no action.

Treat any self-hosted appliance that was internet-facing and unpatched between late August and mid-October as potentially compromised. Preserve logs held off the appliance and a snapshot before changing anything, then follow the fuller detection and remediation steps in GTIG’s analysis and the Cyber Centre’s alert, including rotating any credentials held in the appliance’s vault. Our vulnerability management, incident response and third-party risk guides cover the programme behind those steps.