DaystoPatch

BeyondTrustExploited incident

BeyondTrust Remote Support improper origin validation (BT26-05)

CVE-2026-102764Critical, CVSS 9.3In CISA's Known Exploited Vulnerabilities catalog since 16 Oct 2026

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Google Threat Intelligence Group / Mandiant: ARMORY CASTLE Exploits BeyondTrustCuratedQuote verified

    exploited this vulnerability as a zero-day, in late August 2026.

    Post dated October 15, 2026, published in coordination with BeyondTrust's disclosure.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:31eae56b39a88ddc…
    Used in metrics
    Yes
    Dispute this timestamp
    7 more sources for this moment
    Research: gtiClaimedQuote verified15 Oct 2026

    ARMORY CASTLE Exploits BeyondTrust

    Earliest mention we hold (a vetted outlet).

    Source
    Research: gti research
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1795a465fad9f52e…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    BeyondTrust blog: ARMORY CASTLE and BT26-05 (archived 2026-10-17)CuratedQuote verified15 Oct 2026

    A suspected China-nexus espionage actor exploited a zero-day vulnerability.

    Blog post dated Oct 15, 2026 (page also says 'Last Updated: October 16, 2026, at 12:00 p.m. EDT'). Live page is behind a Cloudflare block for our fetcher, so the Wayback snapshot is cited. Exploitation was private until this coordinated disclosure; per the blog the actor first exploited the bug on August 29, 2026.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c9eaaa6e46f1771e…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-102764ClaimedQuote verified15 Oct 2026, 20:30 UTC

    The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d18cc30ff984dc09…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet15 Oct 2026, 21:41 UTC

    ARMORY CASTLE used a BeyondTrust 0-day to drop a webshell, root the appliance and dump Vault secrets. https://intel.threadlinqs.com/threat/TL-2026-3668 #ThreatIntel #CVE_2026_102764 #SAWFLY #BARECLAW

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet15 Oct 2026, 21:41 UTC

    ARMORY CASTLE used a BeyondTrust 0-day to drop a webshell, root the appliance and dump Vault secrets. 9 detections, 12 IOCs. Full analysis + IOCs: https:// intel.threadlinqs.com/threat/T L-2026-3668

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-102764)ClaimedQuote verified16 Oct 2026

    BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

    Added to CISA's KEV catalog on 2026-10-16.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    News: cisa_advisoriesClaimedQuote verified16 Oct 2026

    CISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations

    Earliest mention we hold (a vetted outlet).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:70d5c723906ec426…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    BeyondTrust security advisory BT26-05 (archived 2026-10-17)CuratedQuote verified

    Issue Date: 10/15/2026

    Advisory gives a date only (US format, 15 October 2026). Live page blocked by Cloudflare for our fetcher; Wayback snapshot cited.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bb221402edb6193f…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    BeyondTrust blog: ARMORY CASTLE and BT26-05 (archived 2026-10-17)CuratedQuote verified

    October 8, 2026: BeyondTrust released the BT26-05 patch for the exploited vulnerability to SaaS and self-hosted customers.

    Patch shipped a week before public disclosure (2026-10-15).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c9eaaa6e46f1771e…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    BeyondTrust security advisory BT26-05 (archived 2026-10-17)CuratedQuote verified9 Oct 2026

    As of Oct 9, 2026, a patch that remediates this vulnerability has been applied to all Remote Support SaaS customers.

    SaaS fleet fully patched by this date; the blog says the patch itself was released on October 8.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bb221402edb6193f…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    BeyondTrust blog: ARMORY CASTLE and BT26-05 (archived 2026-10-17)CuratedQuote verified

    We retested every supported version against the expanded patch and shipped it on October 8.

    Advisory's fixed-versions table: 'BT26-05-RS patch for (v24.3.1 - v26.2.3)'. Self-hosted customers on versions older than 24.3.1 must upgrade first. A PRA patch was released 'out of an abundance of caution'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c9eaaa6e46f1771e…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

BeyondTrust Remote Support zero-day exploited; BT26-05 patch available

A state-linked espionage group exploited an unknown flaw in BeyondTrust Remote Support appliances from late August 2026; BeyondTrust shipped a patch on 8 October and disclosed it on 15 October.

In plain words

BeyondTrust Remote Support, a tool IT teams use to remotely access and fix computers, had a flaw that a state-linked espionage group used in real attacks before anyone knew about it. BeyondTrust released a fix on 8 October 2026 and announced the problem on 15 October; its cloud-hosted customers were patched automatically. If we run our own BeyondTrust appliance, we need to confirm the BT26-05 patch is installed and check the appliance for signs of misuse, because it holds credentials to many of our systems.

What happened and who is affected

What happened

BeyondTrust disclosed CVE-2026-102764 (advisory BT26-05, CVSS v4 9.3) on 15 October 2026: an internal messaging component of Remote Support did not validate where messages came from, letting a remote attacker perform file operations on the appliance. BeyondTrust says the actor first exploited it on 29 August 2026 against one BeyondTrust-hosted instance and one self-hosted appliance. Google's Mandiant attributes the activity to the suspected China-nexus espionage group it calls ARMORY CASTLE (formerly UNC5221) and warns that broader exploitation may follow disclosure.

Who is affected

BeyondTrust Remote Support, all versions up to and including 26.2.3. SaaS instances were patched by BeyondTrust by 9 October 2026. Privileged Remote Access shares the affected code; BeyondTrust found no way to exploit it there but released a patch as a precaution.

CVE-2026-102764. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/beyondtrust-cve-2026-102764/

Affected products

  • BeyondTrust Remote Support (RS)
  • BeyondTrust Privileged Remote Access (PRA)
How we built this timeline

Exploited as a zero-day from 29 Aug 2026 (per BeyondTrust's timeline); BeyondTrust detected it on 28 Sep 2026, shipped the patch 8 Oct 2026 (SaaS fully patched 'As of Oct 9, 2026'), and disclosed publicly on 15 Oct 2026 together with Mandiant.

Because the patch shipped before public disclosure, world (15 Oct 2026) is later than First fix (8 Oct 2026); exploitation still predates the patch, so exploited before a fix is true. BeyondTrust's site returns a Cloudflare block page to our fetcher, so its pages are cited via Wayback snapshots taken 17 Oct 2026; the blog snapshot reflects the 'Last Updated: October 16, 2026' revision.

CVSS is CVSS v4 (9.3) as published by BeyondTrust.

Related

No related incidents.

BeyondTrust report card