A critical vulnerability in BeyondTrust’s Remote Support software is now confirmed to have been exploited before public disclosure, prompting an urgent patch warning for organisations running their own appliances. The flaw, tracked as CVE-2026-102764, can let a remote attacker perform file operations on an affected device without first authenticating.
On October 15, BeyondTrust published security advisory BT26-05, rating the issue critical with a CVSS v4 score of 9.3. Google’s Threat Intelligence Group and Mandiant separately reported evidence that a suspected China-linked espionage group, tracked as ARMORY CASTLE, used the vulnerability as a zero-day in late August. The group’s attribution is an assessment by researchers, not a publicly established identity.
The immediate priority is clear for IT teams: identify every self-hosted BeyondTrust Remote Support appliance, apply the vendor’s fix, and check whether any vulnerable system was exposed before it was patched. BeyondTrust said on October 16 that it knew of two affected customers—one using a vendor-hosted instance and one running a self-hosted appliance—and had not seen evidence of further activity since August. That is not evidence of a broad compromise wave, but it does mean the flaw was used in a real intrusion.
What the BeyondTrust flaw allows
CVE-2026-102764 is an origin-validation weakness in an internal messaging component. Under the right conditions, a remote attacker can trigger file operations on the appliance, including uploading files. BeyondTrust’s advisory lists Remote Support versions through 26.2.3 as affected. The product, formerly known as Bomgar, is used by IT teams to connect to and troubleshoot remote endpoints.
The risk extends beyond the appliance itself. Remote-support systems can hold or broker privileged credentials and provide a route into employee devices and internal networks. If an attacker gains control of the appliance, those stored secrets and trusted support sessions may become stepping stones to other systems.
BeyondTrust also released a patch for Privileged Remote Access (PRA), which shares the affected code. The company says its internal testing did not identify a way to exploit the vulnerability in PRA, but recommends that self-hosted PRA customers apply the patch as a precaution.
What investigators found in the intrusion
In its October 15 technical analysis, Google Threat Intelligence Group and Mandiant described how ARMORY CASTLE moved from initial access to persistent control of a BeyondTrust appliance. Investigators observed a custom web shell called SAWFLY and a tunnelling tool named BARECLAW. The activity included privilege escalation, attempts to access credentials stored by the appliance, changes designed to preserve access after a reboot, and movement towards downstream systems.
The researchers also found that the intruder deleted local logs and other artefacts to hinder detection. That makes off-device records—such as centralised system logs, reverse-proxy records and firewall telemetry—especially important when investigating a potentially exposed appliance.
BeyondTrust says the exploitation occurred on August 29. Its threat-hunting team later identified suspicious activity on a hosted instance on September 28 and contained it within 27 minutes of detection. The company released the patch on October 8 and said its SaaS instances of Remote Support and PRA were automatically patched. Public disclosure followed on October 15.
Which systems need attention?
- Self-hosted Remote Support: all versions up to and including 26.2.3 are listed as affected. Apply the BT26-05-RS patch immediately.
- Self-hosted Privileged Remote Access: apply the corresponding BT26-05 patch because the products share affected code, even though BeyondTrust says it has not reproduced an exploit path in PRA.
- Older installations: if the appliance is older than version 24.3.1, upgrade to a supported version before applying the patch.
- BeyondTrust SaaS: the company says it automatically patched hosted Remote Support and PRA instances on October 8. Customers should confirm their tenant’s status with BeyondTrust if uncertain; patching does not by itself resolve any earlier compromise.
Use the vendor’s official BT26-05 instructions rather than relying on a version number alone. If the patch is not visible in the appliance interface, BeyondTrust advises customers to contact support and reference BT26-05.
Patching is only the first step
Because the vulnerability was exploited before disclosure, organisations that had an internet-reachable, vulnerable appliance during the exposure window should treat it as potentially compromised until it has been reviewed. A successful patch closes the known entry point; it does not remove a web shell, undo a privilege change or invalidate credentials that may already have been stolen.
- Preserve evidence first. If compromise is suspected, coordinate incident response and preserve appliance snapshots and external logs before rebuilding or rebooting where feasible. Attackers may have altered local records.
- Review access and file activity. Look for unrecognised administrator sessions, unexpected scripts in web directories, unexplained permission changes, unusual file transfers and gaps in log forwarding. Compare changes with approved tickets and known administrators.
- Rotate exposed credentials after containment. Once the appliance is patched or rebuilt and the investigation plan is in place, revoke sessions and rotate passwords, API secrets and other credentials the appliance stored or injected. Review the systems those credentials could reach.
- Reduce the attack surface. Restrict administrative interfaces to trusted networks, expose only the endpoints required for support, and forward appliance logs and session events to a separate logging or SIEM platform.
Google and Mandiant warn that ARMORY CASTLE has previously moved from selective zero-day exploitation to broader targeting after a flaw becomes public. That is a warning about the potential next phase, not proof that widespread exploitation of this particular flaw has already occurred. Security teams should patch promptly rather than wait for scanning or attacks to appear in their own logs.
Why Indian IT teams should care
There is no public confirmation that any Indian organisation was among the two customers identified by BeyondTrust, and the company has not disclosed their locations. The relevance for India is operational: enterprises, IT service providers and managed support teams that use remote-access appliances should check their inventories now, including systems operated by vendors on their behalf.
The vulnerability is also listed in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. The US federal remediation deadline is October 19, 2026; that deadline is not an Indian legal requirement, but the listing reflects confirmed exploitation and reinforces the need to prioritise remediation.
The takeaway is not to abandon remote support software. It is to treat an appliance with privileged access as a critical security boundary: keep it patched, limit what can reach its management interfaces, store logs outside the device, and investigate earlier exposure instead of assuming that installing a fix ends the incident.
For the wider technical background, read Mandiant’s analysis of ARMORY CASTLE alongside BeyondTrust’s incident timeline and response guidance.
