BeyondTrust Remote Support zero-day CVE-2026-102764 let China-linked spies take root and pivot downstream. Here's how to check and patch.
Since late August, a Chinese espionage crew has been using an IT help desk's own remote support tool to get into the machines that help desk looks after. The tool is built to let a technician take over a PC to fix it, so it already had all the access they needed.
The product is BeyondTrust Remote Support, which many IT teams and managed service providers use to "jump in" and fix a user's PC. The bug behind the attacks, CVE-2026-102764, went unpatched for more than five weeks while it was being exploited.
CVE-2026-102764 is an authentication bypass in BeyondTrust Remote Support, caused by improper validation of where internal messages come from. In plain terms, the appliance trusts messages that claim to come from inside the system without checking whether they really do. An attacker who can reach the appliance over the network can send those messages and get the box to perform file operations, such as writing a file, without logging in.
Writing one file sounds minor until you remember that this server is a web server. In this case the file was a webshell, a small script that sits on the web server and runs whatever commands the attacker sends it. Once it was in place, the attackers had a foothold.
BeyondTrust rates the flaw CVSS 9.3, and the advisory is tracked as BT26-05. The company serves more than 20,000 customers, including, by its own count, 75% of the Fortune 100.
Mandiant's write-up describes the attack in six steps, from a single uploaded file to full control of the appliance and the machines it manages:
Step five is what makes this attack worse than a typical appliance compromise. A remote support console holds standing access to many machines, and that access is the whole point of the product. Taking the console gives the attacker that access too, delivered through a tool the network already trusts.
Mandiant: an exposed appliance "should be treated as potentially compromised until it has been reviewed."
Yes. BeyondTrust and Mandiant confirm CVE-2026-102764 was exploited as a zero-day from August 29, 2026. The first known victims were one BeyondTrust-hosted appliance and one self-hosted appliance.
According to SecurityWeek, BeyondTrust had a patch ready by September 30. It shipped the fix on October 8 after closing more exploitation paths, and every Remote Support SaaS customer was patched by October 9. Mandiant warns that Armory Castle has a history of "widespread and opportunistic exploitation." The group was behind earlier zero-day campaigns against Citrix NetScaler and Ivanti Connect Secure. Google advises defenders to prepare for broader attacks now that the bug is public.
This is also the third major BeyondTrust remote-access incident in under two years:
You are affected if you run a self-hosted BeyondTrust Remote Support appliance on version 26.2.3 or earlier that hasn't received the BT26-05-RS patch. SaaS (BeyondTrust-hosted) customers were patched automatically by October 9. That covers the bug going forward. It does not prove that nobody got in before then.
Shadowserver tracks more than 1,400 internet-exposed BeyondTrust remote support instances. That number doesn't say how many are patched, but it shows how many front doors there are.
MSPs should pay particular attention. If your help desk uses BeyondTrust to support clients, a compromised appliance gives an attacker a trusted path into every client environment it reaches.
Patch first, then investigate, because patching closes the hole but doesn't remove an attacker who is already inside.
Remote access tools are among the most valuable targets on a network, because whoever controls them controls everything they can reach. Firewalls, VPNs, email gateways, backup consoles and remote support tools have all been hit in October 2026 alone. They share one property: they are trusted, exposed to the internet, and connected to everything behind them.
So there are two questions to ask about your network:
Most teams can answer the first question roughly. Very few can answer the second.
KinoSec is an autonomous AI penetration testing platform that MSPs and MSSPs run for their clients, and it's built to answer both of those questions.
An external network pentest with KinoSec maps what each client actually exposes: remote support consoles, VPN portals, admin panels nobody remembers setting up. It fingerprints products and versions, flags issues like an unpatched BeyondTrust appliance, and writes them up in plain language with remediation steps, in a report you deliver under your own brand.
An Active Directory pentest answers the second question. It starts from a foothold, chains weaknesses the way a real attacker would, and shows how far that access spreads: which credentials it unlocks, which admin paths open up, and which systems come within reach. That lets you show each client what an attacker could reach from a compromised support tool, before an attacker shows them.
One honest caveat: a pentest tells you what's exploitable. It doesn't do forensics on an appliance that may already have been breached, so steps 3–5 above still need to happen. Once patching and cleanup are done, a KinoSec pentest shows whether anything else is still exposed.
CVE-2026-102764 is a critical (CVSS 9.3) authentication bypass in BeyondTrust Remote Support versions 26.2.3 and earlier. Improper validation of message origins lets a remote attacker with no valid login perform file operations on the appliance. Attackers used that to upload a webshell and take full control.
Mandiant and Google Threat Intelligence Group attribute the attacks to Armory Castle, a China-nexus espionage group formerly tracked as UNC5221 and known to CrowdStrike as Warp Panda. Exploitation began on August 29, 2026. The same group previously exploited zero-days in Citrix NetScaler and Ivanti Connect Secure.
BeyondTrust says every Remote Support SaaS customer had the fix applied by October 9, 2026, so the vulnerability is closed for hosted customers. Patching doesn't remove an existing intrusion, though. SaaS customers should still review admin accounts, permission changes and session history since late August.
Apply the BT26-05-RS patch to self-hosted Remote Support versions 24.3.1 through 26.2.3. On a version older than 24.3.1, upgrade first and then apply the patch. Self-hosted Privileged Remote Access customers should also install BeyondTrust's precautionary PRA patch.
Mandiant advises treating any appliance that was internet-exposed on a vulnerable version as potentially compromised until reviewed. Look for unknown PHP webshells, unexpected SUID permission changes, SOCKS proxy or tunneling processes, deleted or missing logs, and unusual RS admin logins or file transfers. If you find any of these, rotate all credentials the appliance stored or brokered and bring in incident response.