# CISA Adds BeyondTrust CVE-2026-102764 Flaw to KEV List

- URL: https://usa-24.com/beyondtrust-cve-2026-102764-patch/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-17T00:49:59.223Z
- Updated: 2026-10-17T00:49:59.231Z
- Topics: Zero-Day Exploits, Remote Access Security, Vulnerability Management, Cybersecurity, Enterprise Security

> CISA added the BeyondTrust CVE-2026-102764 flaw to its KEV catalog after a China-linked group used it as a zero-day since late August. Self-hosted admins face live exposure today.

## Key takeaways

- CISA added BeyondTrust Remote Support flaw CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, 2026.
- The flaw, scored 9.3 critical under CVSS v4, affects Remote Support 26.2.3 and earlier versions.
- BeyondTrust's incident advisory says a China-linked group exploited the flaw as a zero-day on August 29, 2026, against two instances.
- BeyondTrust-hosted SaaS customers are already covered, while self-hosted appliances need the BT26-05-RS patch.
- Self-hosted versions older than 24.3.1 must upgrade before applying the patch, and patching alone does not remove an intruder.

On Friday, the U.S. Cybersecurity and Infrastructure Security Agency added the BeyondTrust CVE-2026-102764 flaw to its Known Exploited Vulnerabilities (KEV) catalog. The listing follows evidence that a China-linked espionage group had been using the bug as a zero-day since late August. Anyone running a self-hosted BeyondTrust Remote Support appliance now faces a federal must-patch flag, and the exploitation is already documented.

## Why the KEV listing changes the urgency

CISA's [alert on the flaw](https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support) calls it a critical authentication bypass in BeyondTrust Remote Support, the product formerly sold as Bomgar. The agency is urging all organizations to act, not only federal offices. The KEV catalog tracks vulnerabilities with evidence of active exploitation, so a listing tells administrators that attackers are already using the bug, not just that a researcher found it.

The root cause is an improper origin validation flaw, classified as CWE-290, in an internal messaging component of Remote Support. The CVSS v4 score is 9.3. That number matters less than the product's job. Remote Support exists to give technicians privileged access to other machines, so a bypass of its authentication check puts the path to those machines in an attacker's hands.

## Which BeyondTrust CVE-2026-102764 versions need the patch

The flaw affects Remote Support 26.2.3 and earlier. Your exposure depends on how you deploy the product, and the fix path changes with your version number.

| Deployment | Status | Action |
|---|---|---|
| BeyondTrust-hosted (SaaS) | Already patched by BeyondTrust | Covered by the vendor's fix, per CISA's alert |
| Self-hosted, version 24.3.1 through 26.2.3 | Patch BT26-05-RS applies directly | Apply BT26-05-RS or confirm it installed automatically |
| Self-hosted, version older than 24.3.1 | Upgrade required first | Upgrade to a newer version, then apply BT26-05-RS |

## How Armory Castle exploited the zero-day

The group that Google Threat Intelligence Group and Mandiant track as ARMORY CASTLE is a suspected China-nexus cyber espionage actor. Mandiant's analysis says the group was previously tracked as UNC5221 and is also known as WARP PANDA. [The Hacker News](https://thehackernews.com/2026/10/china-linked-hackers-exploited.html) reports that the group has been active since October 2023.

According to [BeyondTrust's incident advisory, as summarized by Malware News](https://malware.news/t/cve-2026-102764-beyondtrust-zero-day-exploited/126495), the zero-day was exploited on August 29, 2026, against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. Those are the only victims the advisory names, and the scope of the wider campaign is not public. USA 24 earlier reported that the group exploited the BeyondTrust zero-day for seven weeks before the flaw became public, and [our earlier coverage](https://usa-24.com/beyondtrust-zero-day-remote-support-attack/) walks through that timeline.

Secondary write-ups describe what the attackers did after gaining entry. Those details come from second-hand analysis, so check Mandiant's or Google's primary report before treating any specific technique as settled fact.

## Patch timing and the federal deadline question

BeyondTrust shipped the BT26-05-RS patch on October 8, 2026, and disclosed the vulnerability publicly on October 15. That gap gave customers a week with a fix in hand before the public advisory. CISA added the flaw to KEV on October 16.

Sources disagree on small details. One write-up gives October 9 as the date SaaS tenants were patched, while another says October 8. BeyondTrust's own advisory, BT26-05, is the reference for dates and steps.

Several secondary write-ups also cite an October 19 federal deadline. CISA's alert text does not show that date, so check the KEV entry for the due date before you schedule maintenance around it.

## Steps admins should take today

1. Confirm your version in the appliance console. If you run 24.3.1 or later, the patch can go on directly.
2. Upgrade first if you run anything older than 24.3.1. Move to a newer release, then apply the fix.
3. Apply BT26-05-RS from the /appliance interface, or confirm that it installed automatically.
4. Hunt for compromise. Look for unrecognized privileged sessions, unknown script files, gaps in logs, and unauthorized account or policy changes. CISA lists these indicators.
5. Rotate stored credentials after remediation. [Patching does not evict an attacker](https://hol.org/blog/cve-2026-102764-beyondtrust-remote-support-file-upload-kev) who is already inside, and [guidance from Innovation Network Design](https://www.innovationnetworkdesign.com/articles/intel/beyondtrust-remote-support-zero-day-cve-2026-102764-202610) says to treat exposed appliances as compromised.

## Who is exposed and what the federal directive covers

CISA's directive BOD 26-04 requires federal civilian agencies to prioritize rapid remediation of high-risk vulnerabilities on the KEV catalog. The directive applies only to Federal Civilian Executive Branch agencies. CISA encourages every other organization to adopt risk-based vulnerability management anyway, and this listing shows why. The [agency's October 14 alert](https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog) describes the same directive.

The most exposed organizations run self-hosted Remote Support appliances. That includes companies, managed service providers, healthcare providers, financial firms, and federal and state agencies. These tools hold privileged access and stored credentials, so an attacker who gets past the login check can reach the systems administrators reach. Consumers are not directly affected. This is an enterprise and IT-admin problem.

For a similar federal flag on a network appliance, see USA 24's coverage of [Fortinet's CVE-2025-61624](https://usa-24.com/cve-2025-61624-fortios-attack-patch/).

## What to watch next

Several questions remain open. The number of self-hosted appliances still unpatched is not public. It is also unclear whether victims beyond the one hosted and one self-hosted instance named in BeyondTrust's advisory exist. The federal due date is unconfirmed, and the details of post-entry activity need primary-source verification.

Watch three things. First, the KEV entry itself, which will show the official due date. Second, any Mandiant or Google follow-up that confirms what Armory Castle did inside compromised networks. Third, whether BeyondTrust publishes a count of affected self-hosted customers. Any of those would change how quickly teams move from patching to incident response. For now, the work is straightforward: inventory every appliance, check the version, apply the fix, and search the logs for signs of an intruder who may already have a foothold.

## Frequently asked questions

### Is the BeyondTrust CVE-2026-102764 flaw affecting BeyondTrust-hosted SaaS customers?

According to CISA's alert, organizations using BeyondTrust-hosted (SaaS) Remote Support deployments have already been patched. The action items fall on customers who run self-hosted appliances. Those admins should confirm their deployment type and check their version number.

### Which BeyondTrust Remote Support versions are affected by CVE-2026-102764?

The flaw affects Remote Support 26.2.3 and earlier. Self-hosted versions from 24.3.1 through 26.2.3 can apply the BT26-05-RS patch directly. Anything older than 24.3.1 must be upgraded to a newer version first.

### Who is Armory Castle?

Google Threat Intelligence Group and Mandiant attribute the activity to ARMORY CASTLE, a suspected China-nexus cyber espionage actor. Mandiant says the group was previously tracked as UNC5221 and is also known as WARP PANDA. BeyondTrust's advisory says it exploited the flaw as a zero-day starting August 29, 2026.

### Does patching BeyondTrust Remote Support remove an attacker who is already inside?

No. Patching closes the vulnerability, but it does not evict an intruder who already has access. Admins should hunt for unrecognized privileged sessions, unknown script files, log gaps and unauthorized account changes. They should also rotate stored credentials after remediation.

### Does the KEV listing apply to companies that are not federal agencies?

CISA's BOD 26-04 directive applies only to federal civilian agencies, and it requires them to prioritize rapid remediation of KEV-listed vulnerabilities. CISA encourages all other organizations to adopt risk-based vulnerability management. Any company running a self-hosted Remote Support appliance has the same live exposure regardless of the directive.

## Sources

1. [CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support](https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support)
2. [China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers (The Hacker News)](https://thehackernews.com/2026/10/china-linked-hackers-exploited.html)
3. [CVE-2026-102764: BeyondTrust Remote Support zero-day on CISA KEV. How to fix (HOL)](https://hol.org/blog/cve-2026-102764-beyondtrust-remote-support-file-upload-kev)
4. [CVE-2026-102764: BeyondTrust Zero-Day Exploited (Malware News)](https://malware.news/t/cve-2026-102764-beyondtrust-zero-day-exploited/126495)
5. [BeyondTrust Remote Support Zero-Day Exploited by China-Nexus Spies (Innovation Network Design)](https://www.innovationnetworkdesign.com/articles/intel/beyondtrust-remote-support-zero-day-cve-2026-102764-202610)
6. [CISA Adds Four Known Exploited Vulnerabilities to Catalog (October 14, 2026)](https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog)