On October 16, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) warned that a critical authentication bypass vulnerability in BeyondTrust Remote Support software, tracked as CVE-2026-102764, is being actively exploited by threat actors. This vulnerability affects versions 26.2.3 and earlier and was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, indicating a high risk to federal agencies and private organizations.
The exploit allows attackers to gain initial access and move laterally within compromised systems. BeyondTrust has released patches for supported versions, but organizations using older versions will need to upgrade first. SecurityWeek reports that this exploit was used by a Chinese advanced persistent threat (APT) group to gain initial access. The cyberespionage group Armory Castle exploited the vulnerability as a zero-day in late August 2026.
What happened
On October 16, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) announced patching requirements for a critical vulnerability in BeyondTrust Remote Support (BT Remote Support) Software
- the vulnerability in question is tracked as CVE-2026-102764, with a CVSS score of 9.3 and affects versions 26.2.3 and earlier.
- CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog
- The vulnerability is an authentication bypass error related to improper origin validation in an internal messaging component.
- Patches and the full BeyondTrust security advisory BT26-05-RS are available
BeyondTrust Remote Support software is installed on-site in a company’s datacenter behind their firewall. The software is not SaaS and doesn’t require opening ports on a firewall.
BeyondTrust Remote Support provides remote support to help desks and IT. If a user needs help, they visit the appliance or their company domain to retrieve a custom client application and launch it.
Chinese APT group:
The threat actors leveraging this vulnerability are known as Armory Castle, also tracked as UNC5221 or Warp Panda by other security firms.
- The group has been linked to China and is known for targeting technology companies, especially in sectors where China has geopolitical interests
These attackers have used CVE-2026-102764 for initial access since late summer of 2026.
- After gaining access, the attackers deployed custom tools to establish persistence, escalate privileges, and move laterally across networks
- They deleted logs and artifacts to cover their tracks
Why it matters
The BeyondTrust Remote Support vulnerability presents significant operational risks for businesses and IT teams. CVE-2026-102764 allows threat actors to bypass authentication, gain initial access, and establish persistence within networks.
This means attackers can move laterally within your system, escalate privileges, and deploy custom tools without detection, as described by SecurityWeek. The potential for extensive data breaches and system compromises is high, making immediate action crucial.
Affected users using older versions of Remote Support must first upgrade to supported versions before applying the latest patch. This two-step process could slow down the remediation timeline, extending the window of opportunity for attackers.
Beyond the immediate risk, organizations must also consider the long-term impact on their IT infrastructure. The vulnerability could lead to prolonged downtime and potential loss of control over critical systems during the patch and upgrade process.
Moreover, as noted by The Hacker News, Armory Castle, a China-nexus cyber espionage group is already exploiting this flaw which adds a layer of urgency. Organizations should anticipate potential disruption and implement contingency plans.
Lastly, the addition of CVE-2026-102764 to CISA's Known Exploited Vulnerabilities catalog emphasizes the severity. Non-compliance could result in legal and regulatory repercussions, further complicating the operational impact.
What to do
- Apply the BT26-05-RS patch to BeyondTrust Remote Support, as outlined in BeyondTrust’s Security Advisory BT26-05, immediately. CISA urges this action to mitigate the risk of exploitation.
- Upgrade BeyondTrust Remote Support to versions 24.3.1 or later before applying the patch. Organizations using versions 26.2.3 and earlier must perform this upgrade first. It is crucial for older versions which will not receive the patch directly.
- Regularly monitor for updates and patches. BeyondTrust's Security Advisory BT26-05 is a resource to stay informed on emerging threats and updates.
- Implement a robust vulnerability management program. This helps in proactive identification and remediation of vulnerabilities similar to CVE-2026-102764. According to CISA, proactive management is critical for reducing risks posed by such vulnerabilities.
- Enforce multi-factor authentication (MFA). This added security layer can significantly reduce the likelihood of successful exploit attempts, even if a vulnerability is present. MFA is a best practice recommended by multiple security experts and organizations.
2TI lens
When mitigating vulnerabilities like CVE-2026-102764, organizations must prioritize a layered security approach. Beyond patching, a proactive strategy is to integrate continuous risk assessments, automated monitoring, and spatial digital agency methodologies into the existing security frameworks. This ensures that threats like improper origin validation are managed dynamically, rather than relying on episodic remediation.
Sources
- CISA News
- SecurityWeek
- The Hacker News
- Dark Reading