BeyondTrust patches a Remote Support zero-day that Armory Castle has exploited since August
On October 16, 2026, BeyondTrust fixed CVE-2026-102764, an authentication bypass in Remote Support that the China-linked actor Armory Castle has exploited as a zero-day since late August. If you self-host RS or PRA and the appliance was reachable from the internet, treat it as compromised, not merely as something to patch.
October 16, 2026. BeyondTrust asks its customers to patch CVE-2026-102764, a critical flaw in Remote Support (RS). Late August 2026. The exploitation began, according to Mandiant, which tracks the actor as Armory Castle. 1,400+ appliances exposed to the internet, according to Shadowserver. Why it matters: Remote Support is the tool a helpdesk uses to take control of a company’s endpoints — a zero-day in that tool is initial access to the heart of the network, not a perimeter breach.
What the flaw does
CVE-2026-102764 is an authentication bypass (CWE-290). A remote, unprivileged attacker can perform file operations on an unpatched appliance without holding any account. The flaw affects Remote Support 26.2.3 and earlier. Privileged Remote Access (PRA) shares the same code: BeyondTrust says its internal testing found “no way to exploit” the flaw on PRA, but shipped the patch out of caution anyway.
The remediation timeline is lopsided, and that is the first signal. SaaS customers of Remote Support and Privileged Remote Access were patched by BeyondTrust as early as October 8, 2026. Self-hosted deployments, in contrast, must apply the fix manually if automatic updates are not enabled. In plain terms: those paying for the cloud service are already protected; those who chose on-premises are still exposed, sometimes without knowing it. The fix carries the reference BT26-05 in the vendor’s security center.
The technical detail is deliberately thin — BeyondTrust has not published a CVSS score or a detailed vector in its initial advisory. That silence is consistent with a flaw still under active exploitation: the vendor describes an authentication bypass enabling “file operations,” which is enough to understand the risk. On a remote-support appliance, write access to files is a straight path to a webshell and then to full compromise.
Armory Castle, a collector of appliance zero-days
The attribution raises the stakes. Mandiant and Google Threat Intelligence Group (GTIG) tie the exploitation to Armory Castle — formerly UNC5221, tracked as Warp Panda by CrowdStrike — a China-linked espionage actor. The name is not incidental: Armory Castle has been burning zero-days in edge appliances since October 2023, with a precise track record.
The list is long. Citrix NetScaler via CVE-2023-4966. Ivanti Connect Secure via CVE-2023-46805 and CVE-2024-21887, then CVE-2025-0282. In January 2024, Volexity counted more than 2,100 Ivanti appliances backdoored with the GiftedVisitor webshell. The playbook never changes: a zero-day on the appliance, escalation to root, a webshell, then opportunistic mass exploitation once the flaw goes public.
That is exactly what is shaping up here. Mandiant describes the chain: initial access via CVE-2026-102764, escalation from the web service account to root by enabling the SUID bit, deployment of the Sawfly webshell and Bareclaw tunneler, log wiping, then lateral movement with compromised Administrator credentials. “After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host,” Mandiant writes. “This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset.”
Why patching is not enough this time
The tipping point is what the tool is. Remote Support is not an ordinary server: it is an appliance that stores or brokers the credentials it uses to open sessions on endpoints and servers across the network. When an attacker becomes root on that appliance, they are not compromising one machine — they inherit the keys to every machine the support team was allowed to reach.
Mandiant is explicit about the consequence: “Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed.” The patch closes the door for the future; it proves nothing about the past. An attacker who already holds root could have wiped the logs — and Armory Castle does exactly that before moving laterally.
The risk of a second wave is real. Mandiant warns that, in past campaigns, Armory Castle “conducted widespread and opportunistic exploitation following the public disclosure of vulnerabilities it had exploited selectively as zero-days.” The October 16 disclosure may therefore trigger a surge of attempts against still-unpatched appliances — which is why the urgency extends beyond BeyondTrust customers.
2026, the year of edge appliances
This CVE is not an isolated incident: it sits inside a sequence that is accelerating. Over the past twelve months, remote-access and edge appliances have been the favored target of espionage actors, and ETTAYEB has documented part of that run. Ivanti Connect Secure was hit by a fresh zero-day as recently as October 13, 2026. Palo Alto Networks patched a management-interface RCE in PAN-OS on October 14. Cisco, Fortinet and Juniper have all shipped emergency fixes for their network-appliance lines this year. The common thread is striking: these are the boxes you place at the edge and forget to segment.
The deeper lesson is not “patch faster” — it is “shrink the surface.” A remote-support appliance has no business being reachable from the internet without restriction. Every incident in this series begins with a management interface or port exposed beyond what is necessary, and ends with root escalation and a webshell. BeyondTrust is no exception: the vendor serves more than 20,000 customers, including 75% of the Fortune 100 and government agencies, which makes it a very high-value target.
The vendor’s recent history confirms the risk. In 2025, the Silk Typhoon group exploited two zero-days — CVE-2024-12356 and CVE-2024-12686 — to breach BeyondTrust’s SaaS systems and compromise 17 instances, including the U.S. Treasury’s. More recently, CVE-2026-1731, a critical RCE on the same appliances, was exploited to deploy ransomware. The recurrence is the message: these tools are now a permanent hunting ground.
What to do now
The response is two actions, in this order: investigate before patching, then patch. The order matters, because patching erases the most valuable evidence — the appliance’s state before remediation.
First, map your exposure. List every Remote Support and Privileged Remote Access appliance in your estate, and determine which ones were reachable from the internet on version 26.2.3 or earlier between late August and October 8. Shadowserver tracks more than 1,400 exposed instances: if yours was not behind restricted access, it may well be among them.
Second, look for evidence outside the appliance. The appliance’s own logs are no longer trustworthy once the attacker is root. Correlate network flows and centralized collectors: unusual outbound connections, sessions opened on downstream hosts, or a file that survives a reboot. A tunneler like Bareclaw leaves network traffic even when local logs have been cleared.
Third, patch. Apply the BT26-05 fix on every self-hosted instance, RS and PRA alike, without waiting for the next maintenance window. On the SaaS side, customers have been patched since October 8: confirm it in the console, do not assume it.
Verdict
Treat CVE-2026-102764 as a potential compromise incident, not a bulletin to apply. If you self-host Remote Support or Privileged Remote Access, first determine whether the appliance was internet-reachable on a vulnerable version — and if so, run a forensic investigation before patching, because the patch erases the state you need to examine. If you are a SaaS customer, the October 8 fix already covers you: simply verify your instance is current. Either way, assume Armory Castle will likely attempt widespread opportunistic exploitation now that the flaw is public — the window to act is days, not weeks.