CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

In its BT26-05 advisory, BeyondTrust says the components did not adequately validate the origin of the messages it received.[2] The Hacker News reports that the flaw carries a CVSS score of 9.3[3].According to Google's Mandiant, the flaw affects all supported Remote Support versions up to 26.2.3[4] and could lead to "host-level control and access to every credential the appliance stores or brokers."According to The Hacker News, BeyondTrust's timeline says Armory Castle exploited the flaw as a zero-day on a single self-hosted Remote Support appliance on August 29, 2026.[3] Cyberupdates365 reports that Google and Mandiant say the group was previously tracked as UNC5221 and also known as WARP PANDA.[5]Mandiant says the threat actor used newly identified custom malware, the SAWFLY webshell and the BARECLAW tunneler[4].BeyondTrust says that as of Oct 9, 2026, a patch that remediates this vulnerability has been applied to all Remote Support SaaS customers.[2]CISA urges organizations with affected self-hosted Remote Support appliances to immediately take the actions within this alert[6], which include isolating any appliances suspected of compromise.BleepingComputer reports that Shadowserver tracks over 1,400 BeyondTrust remote support instances exposed online[1]. Google's threat intelligence group warns that the group may carry out widespread exploitation[4] now that the flaw has been disclosed.