CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

BeyondTrust's advisory says the affected components "did not adequately validate the origin of the messages it received"[2] and that, under the right conditions, this could be used to perform file operations on the appliance. According to CISA, the flaw affects BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier.[3]Beazley Security reports that BeyondTrust confirmed that ARMORY CASTLE exploited this vulnerability against one BeyondTrust-hosted instance and one self-hosted appliance beginning August 29th, 2026.[4] SOCRadar reports that GTIG and Mandiant attributed the attacks to ARMORY CASTLE, formerly tracked as UNC5221, which GTIG describes as a suspected PRC-nexus espionage actor[5].According to Mandiant, the threat actor used newly identified custom malware, the SAWFLY webshell and the BARECLAW tunneler[6]. Beazley says the actor also attempted to dump the appliance's credential vault with the native bt-secrets utility[4].BeyondTrust says that as of Oct 9, 2026, all Remote Support SaaS customers have been patched, while self-hosted customers should apply the patch manually if they are not subscribed to automatic updates[2].The Hacker News reports that CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by October 19, 2026.[1]BeyondTrust warned that once a flaw is public, the actor "typically moves to broad exploitation of every instance still unpatched."[7] SOCRadar reports that as of the October 15 analysis, widespread exploitation of CVE-2026-102764 had not been confirmed.[5]