Unauthenticated message-origin bypass allows file operations and appliance takeover in BeyondTrust Remote Support (CVE-2026-102764)
BeyondTrust published advisory BT26-05 and a fix on 2026-10-15 after Google Threat Intelligence attributed zero-day use since late August 2026 to the China-nexus group Armory Castle (UNC5221), so an unpatched, internet-facing Remote Support appliance should be treated as a likely target already.
Internal components of BeyondTrust Remote Support do not validate the origin of messages they receive, letting an unauthenticated remote attacker perform file operations on the appliance. Reports describe the flaw as an authentication bypass / file upload used to take over Remote Support servers.
Affected: BeyondTrust Remote Support 26.2.3 and earlier
How to Test
Check the Remote Support appliance version in the administrative interface: any build 26.2.3 or earlier is affected. Because exploitation reportedly dates to late August 2026, review the appliance for unexpected files, modified components, and unexplained file operations or sessions since then, and compare against the indicators in the Google Threat Intelligence Armory Castle write-up and BeyondTrust KB0024066; treat any match as a compromise of the appliance and the credentials and sessions it brokers.
How to Patch
Apply the fix released with BeyondTrust advisory BT26-05, upgrading self-hosted Remote Support appliances to a release newer than 26.2.3; prioritize any appliance reachable from the internet.