BeyondTrust Zero-Day Gave Suspected China-Linked Hackers Seven Weeks of Access Before the Patch Arrived

BeyondTrust has disclosed a critical flaw in its Remote Support product that a suspected China-linked espionage group exploited as a zero-day for about seven weeks before the public learned of it. The vulnerability, tracked as CVE-2026-102764 and rated 9.3 on the CVSS scale, lets an unauthenticated remote attacker perform file operations on a vulnerable appliance and take over the host. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalogue on October 16.

According to BeyondTrust and incident responders at Mandiant and Google's Threat Intelligence Group, exploitation began on August 29, 2026, when attackers compromised one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. BeyondTrust detected the hosted compromise during proactive threat hunting on September 28 and reproduced the entry method the same day. It released patches on October 8 and publicly disclosed the flaw on October 15, a gap of roughly seven weeks between first exploitation and disclosure.

Software-as-a-service customers were patched automatically, with sources giving October 8 or 9 for the remediation. Organisations that run their own self-hosted appliances must apply the update manually.

CVE-2026-102764 is an improper origin validation weakness in an internal messaging component of Remote Support, a tool formerly known as Bomgar that IT teams use to connect to and control remote devices. Because the component does not properly verify where incoming messages come from, an attacker with no credentials can perform arbitrary file operations and ultimately gain control of the appliance. Some analyses describe the outcome as root-level access.

The vulnerability affects self-hosted Remote Support versions from 24.3.1 up to and including 26.2.3. Privileged Remote Access shares the affected code. BeyondTrust's testing found no exploitable path in that product, but it issued a precautionary patch. The fix is delivered in update BT26-05-RS.

Google's threat intelligence team attributes the activity to a group it tracks as Armory Castle, previously known as UNC5221 and Warp Panda. The group is a suspected China-nexus espionage actor and has been active since at least October 2023. Researchers say it deployed custom malware, including a web shell known as SAWFLY, and stole credentials.

BeyondTrust notes that the group tends to use a zero-day selectively against chosen targets and then moves to broad exploitation of every unpatched system once a vulnerability becomes public. That makes the post-disclosure period especially dangerous for organisations that have not yet patched.

BeyondTrust has been a repeated target. Attackers recently exploited another critical remote code execution flaw, CVE-2026-1731, in Remote Support and Privileged Remote Access to set up WebSocket channels and deploy ransomware. Earlier, a Chinese state-backed group known as Silk Typhoon was blamed for using stolen API keys to compromise 17 Remote Support SaaS instances, including one belonging to the US Treasury Department.

Remote support and privileged access tools are attractive targets because they sit at the heart of IT operations and often hold powerful credentials. Compromising one can give an attacker a trusted route into many systems at once.

CISA's catalogue entry requires Federal Civilian Executive Branch agencies to apply the fix by October 19, 2026. Private organisations are not bound by that deadline, but the agency's listing is widely used as a signal of which flaws need immediate attention.

The incident shows how a single weakness in an IT management tool can quietly give attackers access for weeks. It also highlights the growing pressure on security teams who must race to patch systems after disclosure while also checking whether attackers got in beforehand. Vendors' use of proactive threat hunting, as BeyondTrust did here, can shorten that window, but defenders still need to verify their own environments.