CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

BeyondTrust's advisory says it "has remediated a critical vulnerability in Remote Support (RS) that could allow a remote attacker to perform file operations on an affected appliance."[2] According to the company, the affected components "did not adequately validate the origin of the messages it received."[2]BleepingComputer reports that the flaw affects RS 26.2.3 or earlier[3]. SOC Prime says it carries a CVSS 4.0 score of 9.3[4].According to Rapid7, CISA added the flaw to its list of known exploited vulnerabilities on October 16, 2026, based on evidence of active exploitation.[5] CISA said it "urges organizations with affected self-hosted Remote Support appliances to immediately take the actions within this alert."[6]Google Threat Intelligence Group and Mandiant attribute the observed exploitation to ARMORY CASTLE, formerly tracked as UNC5221[4], SOC Prime reports. Mandiant said the group used newly identified custom malware, the SAWFLY webshell and the BARECLAW tunneler[7].watchTowr reports that the attacker escalated to root-level control of the host, harvested credentials stored on the appliance, and set up persistence that survived reboots.[8]BeyondTrust says that as of Oct 9, 2026, a patch that remediates this vulnerability has been applied to all Remote Support SaaS customers.[2] It adds that customers on a Remote Support version older than 24.3.1 will need to upgrade to a newer version to apply this patch.[2]BleepingComputer reports that Shadowserver tracks over 1,400 BeyondTrust remote support instances exposed online[3]. Google warns that ARMORY CASTLE may conduct widespread exploitation[7] now that the flaw is public.