BeyondTrust Remote Support Zero-Day Exploited Since August by China-Linked Group

A critical flaw in BeyondTrust Remote Support, the remote access tool formerly sold as Bomgar, was exploited as a zero-day for about seven weeks before it was disclosed. The bug, CVE-2026-102764, is rated 9.3 on CVSS v4.0 and lets an unauthenticated attacker perform file operations on the appliance, including uploading files, without any user interaction.

CISA added it to its Known Exploited Vulnerabilities catalogue on 16 October and gave US federal agencies until 19 October to fix it.

What is affected

BeyondTrust's advisory BT26-05 describes the flaw as an authentication bypass: internal messaging components did not properly check where the messages they received came from. CISA's alert lists Remote Support versions 26.2.3 and earlier as affected.

• Hosted (SaaS) Remote Support and Privileged Remote Access: patched automatically by BeyondTrust. No action needed.
• Self-hosted appliances on 24.3.1 or later: apply the BT26-05-RS patch.
• Self-hosted appliances older than 24.3.1: upgrade to a supported version first, then apply the patch.

BeyondTrust says its own testing found no way to exploit the flaw in Privileged Remote Access, but because PRA shares the affected code it has released a precautionary patch for it as well. NHS England's alert describes PRA as possibly affected, so organisations running it should patch rather than wait.

Seven weeks of exploitation

According to BeyondTrust and Mandiant, exploitation began on 29 August 2026 against one BeyondTrust-hosted instance and one self-hosted appliance. The flaw was disclosed publicly in mid-October, after the hosted instances had already been patched.

Mandiant attributes the activity to a group it now calls ARMORY CASTLE, a suspected China-nexus espionage actor it previously tracked as UNC5221. Reported activity after gaining access included deploying a web shell, escalating privileges to root, attempting to extract stored credentials, moving on to downstream systems and deleting logs.

Remote support appliances are a valuable target for this kind of operation. They hold credentials and live connections into the systems an organisation's help desk and IT staff support, so one compromised appliance can open a path to many others.

What to do now

CISA's guidance for organisations running self-hosted appliances:

1. Patch with BT26-05-RS, upgrading first if the appliance is older than 24.3.1.
2. Restrict exposure. Limit external access to the services that are needed and keep administrative interfaces on trusted networks.
3. Assume compromise where it is possible. Mandiant advises treating any appliance that was reachable from the internet on a vulnerable version during the exploitation window as potentially compromised until it has been reviewed.

If compromise is suspected, CISA recommends isolating the appliance, preserving a snapshot or forensic image, and collecting logs from the firewall, web application firewall and reverse proxy, since the appliance's own logs may have been deleted. It then advises hunting for unrecognised privileged sessions, unknown script files and gaps in logs, rebuilding from a known-good state, rotating every credential the appliance stored or injected, revoking active support sessions and reviewing new multi-factor authentication registrations on privileged accounts.