On Friday, the U.S. Cybersecurity and Infrastructure Security Agency added the BeyondTrust CVE-2026-102764 flaw to its Known Exploited Vulnerabilities (KEV) catalog. The listing follows evidence that a China-linked espionage group had been using the bug as a zero-day since late August. Anyone running a self-hosted BeyondTrust Remote Support appliance now faces a federal must-patch flag, and the exploitation is already documented.
Why the KEV listing changes the urgency
CISA's alert on the flaw calls it a critical authentication bypass in BeyondTrust Remote Support, the product formerly sold as Bomgar. The agency is urging all organizations to act, not only federal offices. The KEV catalog tracks vulnerabilities with evidence of active exploitation, so a listing tells administrators that attackers are already using the bug, not just that a researcher found it.
The root cause is an improper origin validation flaw, classified as CWE-290, in an internal messaging component of Remote Support. The CVSS v4 score is 9.3. That number matters less than the product's job. Remote Support exists to give technicians privileged access to other machines, so a bypass of its authentication check puts the path to those machines in an attacker's hands.
Which BeyondTrust CVE-2026-102764 versions need the patch
The flaw affects Remote Support 26.2.3 and earlier. Your exposure depends on how you deploy the product, and the fix path changes with your version number.
| Deployment | Status | Action |
|---|---|---|
| BeyondTrust-hosted (SaaS) | Already patched by BeyondTrust | Covered by the vendor's fix, per CISA's alert |
| Self-hosted, version 24.3.1 through 26.2.3 | Patch BT26-05-RS applies directly | Apply BT26-05-RS or confirm it installed automatically |
| Self-hosted, version older than 24.3.1 | Upgrade required first | Upgrade to a newer version, then apply BT26-05-RS |
How Armory Castle exploited the zero-day
The group that Google Threat Intelligence Group and Mandiant track as ARMORY CASTLE is a suspected China-nexus cyber espionage actor. Mandiant's analysis says the group was previously tracked as UNC5221 and is also known as WARP PANDA. The Hacker News reports that the group has been active since October 2023.
According to BeyondTrust's incident advisory, as summarized by Malware News, the zero-day was exploited on August 29, 2026, against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. Those are the only victims the advisory names, and the scope of the wider campaign is not public. USA 24 earlier reported that the group exploited the BeyondTrust zero-day for seven weeks before the flaw became public, and our earlier coverage walks through that timeline.
Secondary write-ups describe what the attackers did after gaining entry. Those details come from second-hand analysis, so check Mandiant's or Google's primary report before treating any specific technique as settled fact.
Patch timing and the federal deadline question
BeyondTrust shipped the BT26-05-RS patch on October 8, 2026, and disclosed the vulnerability publicly on October 15. That gap gave customers a week with a fix in hand before the public advisory. CISA added the flaw to KEV on October 16.
Sources disagree on small details. One write-up gives October 9 as the date SaaS tenants were patched, while another says October 8. BeyondTrust's own advisory, BT26-05, is the reference for dates and steps.
Several secondary write-ups also cite an October 19 federal deadline. CISA's alert text does not show that date, so check the KEV entry for the due date before you schedule maintenance around it.
Steps admins should take today
- Confirm your version in the appliance console. If you run 24.3.1 or later, the patch can go on directly.
- Upgrade first if you run anything older than 24.3.1. Move to a newer release, then apply the fix.
- Apply BT26-05-RS from the /appliance interface, or confirm that it installed automatically.
- Hunt for compromise. Look for unrecognized privileged sessions, unknown script files, gaps in logs, and unauthorized account or policy changes. CISA lists these indicators.
- Rotate stored credentials after remediation. Patching does not evict an attacker who is already inside, and guidance from Innovation Network Design says to treat exposed appliances as compromised.
Who is exposed and what the federal directive covers
CISA's directive BOD 26-04 requires federal civilian agencies to prioritize rapid remediation of high-risk vulnerabilities on the KEV catalog. The directive applies only to Federal Civilian Executive Branch agencies. CISA encourages every other organization to adopt risk-based vulnerability management anyway, and this listing shows why. The agency's October 14 alert describes the same directive.
The most exposed organizations run self-hosted Remote Support appliances. That includes companies, managed service providers, healthcare providers, financial firms, and federal and state agencies. These tools hold privileged access and stored credentials, so an attacker who gets past the login check can reach the systems administrators reach. Consumers are not directly affected. This is an enterprise and IT-admin problem.
For a similar federal flag on a network appliance, see USA 24's coverage of Fortinet's CVE-2025-61624.
What to watch next
Several questions remain open. The number of self-hosted appliances still unpatched is not public. It is also unclear whether victims beyond the one hosted and one self-hosted instance named in BeyondTrust's advisory exist. The federal due date is unconfirmed, and the details of post-entry activity need primary-source verification.
Watch three things. First, the KEV entry itself, which will show the official due date. Second, any Mandiant or Google follow-up that confirms what Armory Castle did inside compromised networks. Third, whether BeyondTrust publishes a count of affected self-hosted customers. Any of those would change how quickly teams move from patching to incident response. For now, the work is straightforward: inventory every appliance, check the version, apply the fix, and search the logs for signs of an intruder who may already have a foothold.
