# BeyondTrust Zero-Day CVE-2026-102764: Patch Now, Then Rebuild

- URL: https://usa-24.com/beyondtrust-remote-support-zero-day/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-17T10:26:56.329Z
- Updated: 2026-10-17T10:26:56.335Z
- Topics: Zero-Day Vulnerabilities, Remote Access Security, BeyondTrust, CISA Known Exploited Vulnerabilities, Armory Castle

> Attackers exploited a critical BeyondTrust Remote Support zero-day from August 29 until patches shipped October 8. CISA set a federal deadline of October 19 to act.

## Key takeaways

- BeyondTrust disclosed CVE-2026-102764 on October 15 and rated it critical, with a CVSS 4.0 score of 9.3.
- Remote Support 26.2.3 and earlier are affected, and versions 24.3.1 through 26.2.3 get patch BT26-05-RS.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16, with a federal due date of October 19.
- Attackers began exploiting the bug on August 29, and BeyondTrust released patches on October 8.
- Mandiant advises that an exposed appliance may need a rebuild in addition to a patch, and it expects wider exploitation attempts.

Attackers exploited a critical BeyondTrust Remote Support zero-day from August 29 until the company shipped a patch on October 8. The Cybersecurity and Infrastructure Security Agency (CISA) then added the flaw, CVE-2026-102764, to its [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) on October 16 and set a federal deadline of October 19.

The bug lets an unauthenticated attacker perform remote file operations on a product built to hold some of an organization's most sensitive access. Patches now exist, but the guidance circulating in Germany and the United States goes further. It urges administrators to rebuild exposed appliances in addition to patching them.

## Why BeyondTrust Remote Support is a high-value target

BeyondTrust rated CVE-2026-102764 critical, with a CVSS 4.0 score of 9.3, when it [disclosed the flaw on October 15](https://socprime.com/blog/cve-2026-102764-beyondtrust-zero-day-exploited/). Remote Support is a privileged-access tool. It often holds administrative credentials, API secrets and live support sessions, so compromising one instance can expose the broader network behind it.

Google Threat Intelligence Group and Mandiant say a China-linked group exploited the bug as a zero-day, [SecurityWeek reported](https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/). Write-ups describe attackers using the flaw to reach root, upload a webshell, harvest credentials and wipe logs. The log deletion matters most to responders, because a clean-looking log does not prove a clean appliance.

BeyondTrust confirmed two intrusions, one on a BeyondTrust-hosted instance and one on a self-hosted appliance, according to [SOCRadar](https://socradar.io/blog/cve-2026-102764-beyondtrust-zero-day/). The sources reviewed do not give a count of affected customers, so those two confirmed intrusions are the only hard victim figure available.

## Timeline of the BeyondTrust zero-day

| Date (2026) | What happened |
|---|---|
| August 29 | Attackers begin exploiting the flaw |
| September 28 | BeyondTrust detects the hosted intrusion during proactive hunting |
| October 8 | BeyondTrust releases patches |
| October 9 | SaaS instances are patched |
| October 15 | BeyondTrust publicly discloses the CVE |
| October 15 and 16 | Germany's Federal Office for Information Security (BSI) issues advisory 2026-297832 |
| October 16 | CISA adds the flaw to the KEV catalog |
| October 19 | Federal KEV deadline |

The gap between the first exploitation and the public patch is more than five weeks. Customers running self-hosted appliances had no fix to install for that entire period.

## Which BeyondTrust Remote Support versions are affected

- Affected: Remote Support 26.2.3 and earlier.
- Versions 24.3.1 through 26.2.3: apply patch BT26-05-RS.
- Versions older than 24.3.1: upgrade first, then apply the fix.

SaaS instances were patched by October 9, according to SOCRadar. Self-hosted customers carry the rest of the work, and that work includes more than installing the update.

## Why guidance now points to rebuilding, not only patching

A patch closes the flaw going forward. It does not remove a webshell or undo credential theft that happened earlier. That is why [Mandiant advises](https://www.thehackacademy.com/beyondtrust-remote-support-intrusions.htm) that an exposed appliance may need a rebuild in addition to a patch.

Germany's BSI issued advisory 2026-297832 on October 15 and 16, according to [Tech Insider](https://tech-insider.org/beyondtrust-remote-support-zero-day-armory-castle-2026/). Reporting on that German advice and on US guidance says both now urge rebuilding appliances alongside patching. A rebuild means reinstalling the appliance from a clean state, then rotating every secret it held.

Speed matters too. A [daily.dev summary of the reporting](https://daily.dev/posts/beyondtrust-zero-day-continues-trend-of-exploited-edge-bugs-vt69o6gmn) says Mandiant saw a webshell deployed within 11 minutes of weaponization in activity it tracks as SAWFLY. When attackers move that quickly, a patch-first plan leaves little margin for error.

## Who is behind the attacks and what Mandiant expects next

Mandiant and Google Threat Intelligence Group attribute the activity to ARMORY CASTLE, also tracked as UNC5221 and WARP PANDA. The group has a history of targeting internet-facing security appliances. BeyondTrust said this CVE is the latest in a string of its products exploited in recent years, according to [BleepingComputer](https://bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august).

The bigger concern is the pattern. Armory Castle has historically exploited flaws selectively as zero-days, then broadened its attacks once a patch became public. That history explains Mandiant's warning. In the company's words, as BleepingComputer cited them: "It is possible that we will observe similar widespread exploitation attempts associated with CVE-2026-102764."

USA 24 has covered the group's campaign in more depth in our report on [China-linked Armory Castle's seven-week exploitation of the BeyondTrust zero-day](https://usa-24.com/beyondtrust-zero-day-remote-support-attack/).

## Who is exposed and what to do this week

Any US organization running self-hosted BeyondTrust Remote Support is exposed. That includes IT help desks, managed service providers, banks, healthcare systems and federal contractors. Federal civilian agencies face the October 19 deadline in CISA's catalog listing, which we covered in [our KEV story](https://usa-24.com/beyondtrust-cve-2026-102764-patch/).

Work through these steps in order:

1. Confirm your version. Remote Support 26.2.3 and earlier are affected.
2. If you run 24.3.1 through 26.2.3, apply patch BT26-05-RS. If you run anything older, upgrade first.
3. Review the appliance for signs of compromise, such as unfamiliar files and unexpected configuration changes.
4. If compromise is possible, rebuild the appliance from a clean state rather than patching it in place.
5. Rotate credentials, API secrets and any credentials stored on the appliance.
6. Check logs for gaps, since attackers reportedly deleted logs and artifacts.

A clean scan does not settle the question. BeyondTrust has withheld some exploitation details to limit copycat attacks, and Mandiant had not released full indicators of compromise in the sources reviewed. Treat the patch, the log review and the rebuild decision as one process.

## Open questions and a related Fortinet listing

The sources disagree on when the activity was first noticed. SOCRadar says BeyondTrust detected the hosted intrusion on September 28 during proactive hunting. [ThreatCluster](https://threatcluster.io/cluster/critical-zero-day-exploit-in-beyondtrust-remote-support-disc-f533e0cb) says BeyondTrust identified exploitation on August 29. Both sources agree on the August 29 start and the October 8 patch.

CISA's listing drew attention for another reason. According to [Matrice Digitale](https://www.matricedigitale.it/2026/10/17/beyondtrust-fortinet-kev-cisa-cve-2026-102764-armory-castle/), an Italian outlet, CISA listed a Fortinet flaw, CVE-2025-61624, alongside the BeyondTrust bug the same week. USA 24 covered that Fortinet issue in [our separate story](https://usa-24.com/cve-2025-61624-fortinet-attack-patch/). One catalog snippet also appears to place the BeyondTrust CVE under a Fortinet heading. That looks like a layout artifact, since the BeyondTrust-specific sources and the Italian report tie the CVE to BeyondTrust.

Two gaps remain open. The number of affected customers is not public in the sources reviewed, and neither is whether any US organization is among the confirmed victims. It is also unknown whether the wider exploitation Mandiant anticipates has begun.

## What to watch before and after October 19

Three things will show whether this becomes a wider campaign. The first is the October 19 deadline, which federal civilian agencies must meet. The second is whether the broad exploitation Mandiant expects appears in new victim reports. The third is whether BeyondTrust or Mandiant publish fuller indicators of compromise.

Private companies face no federal deadline, but the exposure is the same for them. The rebuild question will outlast the deadline for any team that finds signs of compromise on a self-hosted appliance, and it is likely to shape how security teams handle the next remote-support flaw.

## Frequently asked questions

### Which BeyondTrust Remote Support versions are affected by CVE-2026-102764?

Remote Support 26.2.3 and earlier are affected. Versions 24.3.1 through 26.2.3 get patch BT26-05-RS, and older versions must upgrade first. BeyondTrust patched SaaS instances by October 9.

### Is patching enough, or should I rebuild the appliance?

Mandiant advises that an exposed appliance may need a rebuild in addition to a patch, because a patch does not remove a webshell or undo stolen credentials. Reporting on German and US guidance says both now urge rebuilding appliances alongside patching. Check the appliance for signs of compromise first, then rebuild from a clean state if compromise is possible.

### What is the federal deadline for the BeyondTrust flaw?

CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16 and set a federal due date of October 19. Federal civilian agencies must meet that deadline. Private organizations face no federal deadline, but they are exposed to the same attacks if they run self-hosted Remote Support appliances.

### Who is ARMORY CASTLE?

Mandiant and Google Threat Intelligence Group attribute the BeyondTrust exploitation to ARMORY CASTLE, also tracked as UNC5221 and WARP PANDA. The group has a history of targeting internet-facing security appliances. Mandiant has also said the group has broadened attacks after patches became public in the past.

## Sources

1. [CVE-2026-102764: Critical BeyondTrust Remote Support Zero-Day Exploited by China-Linked Hackers](https://socprime.com/blog/cve-2026-102764-beyondtrust-zero-day-exploited/)
2. [CVE-2026-102764: BeyondTrust Zero-Day Exploited](https://socradar.io/blog/cve-2026-102764-beyondtrust-zero-day/)
3. [Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day](https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/)
4. [BeyondTrust patches zero-day exploited in attacks since August](https://bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august)
5. [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
6. [Two Remote Support intrusions, and the patch versus rebuild question](https://www.thehackacademy.com/beyondtrust-remote-support-intrusions.htm)
7. [BeyondTrust Zero-Day CVE-2026-102764 Explained [2026]](https://tech-insider.org/beyondtrust-remote-support-zero-day-armory-castle-2026/)
8. [BeyondTrust e Fortinet nel KEV: CISA ordina patch e bonifica immediata](https://www.matricedigitale.it/2026/10/17/beyondtrust-fortinet-kev-cisa-cve-2026-102764-armory-castle/)
9. [Critical Zero-Day Exploit Found in BeyondTrust Remote Support](https://threatcluster.io/cluster/critical-zero-day-exploit-in-beyondtrust-remote-support-disc-f533e0cb)
10. [BeyondTrust Zero-Day Continues Trend of Exploited Edge Bugs](https://daily.dev/posts/beyondtrust-zero-day-continues-trend-of-exploited-edge-bugs-vt69o6gmn)