BeyondTrust Remote Support Zero-Day Actively Exploited by Chinese State-Sponsored Group

A critical authentication bypass vulnerability, CVE-2026-102764, in BeyondTrust Remote Support (formerly Bomgar) is being actively exploited in the wild by a Chinese state-sponsored threat actor known as Armory Castle (also tracked as UNC5221 or Warp Panda). The flaw, with a CVSS score of 9.3, allows a remote attacker to perform file operations on the appliance due to improper origin validation in an internal messaging component. BeyondTrust has released patches for supported versions (24.3.1 and later), and SaaS customers have already received updates. Self-hosted customers on affected versions (0 through 26.2.3) must manually apply the BT26-05-RS patch or upgrade to a newer version if running older than 24.3.1. This vulnerability is highly significant for any organization utilizing BeyondTrust Remote Support, as it directly impacts a tool designed for privileged access to systems. Successful exploitation grants attackers a critical foothold, enabling them to establish persistence, escalate privileges, and move laterally across the network. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) Catalog, underscoring the severity and active threat. This mandates federal agencies to apply fixes by October 19, 2026, highlighting the immediate need for all organizations to prioritize patching. This incident fits into a broader, well-established trend of state-sponsored actors targeting critical infrastructure and widely used enterprise software for espionage and intellectual property theft. Similar campaigns have seen Armory Castle exploit zero-day vulnerabilities in other popular appliances like Citrix NetScaler and Ivanti Connect Secure. The focus on remote access and identity management solutions is a consistent tactic, as these tools provide direct pathways into sensitive systems. The rapid weaponization of newly disclosed vulnerabilities, often before patches are widely deployed, further emphasizes the need for proactive security measures and rapid response capabilities. In practice, organizations must immediately identify all instances of BeyondTrust Remote Support within their environments and apply the relevant patches. For self-hosted deployments, this means a manual update process. Beyond patching, it is crucial to conduct thorough network and memory forensics on any appliance that was internet-reachable during the exploitation window (since late August 2026) to detect signs of compromise. Organizations should also limit external access to these appliances to only necessary services and hunt for indicators of threat actor activity, including unrecognized privileged sessions. If compromise is suspected, isolating the appliance and rebuilding from a known-good state is imperative. This event also serves as a stark reminder to review and strengthen overall privileged access management (PAM) strategies and ensure robust monitoring for anomalous activity around such critical tools.