BeyondTrust disclosed CVE-2026-102764 on 15 October. Attackers used it as a zero-day against Remote Support from 29 August, before a patch existed. The vendor score is CVSS 9.3.
What happened
Internal messaging components on Remote Support did not check where a message came from. Under the right conditions, a remote attacker with no credentials can perform file operations on the appliance.
BeyondTrust says the first confirmed hits were on 29 August: one hosted Remote Support instance and one self-hosted appliance. The vendor found the hosted case on 28 September and contained it within 27 minutes. SaaS instances of Remote Support and Privileged Remote Access were patched on 8 October. The public advisory and CVE landed on 15 October.
The vendor attributes the activity, with moderate to high confidence, to a China-nexus cluster Mandiant now calls Armory Castle (previously UNC5221). CrowdStrike tracks the same cluster as Warp Panda. After getting in, the operator planted a web shell, moved to full administrative control within minutes, read stored secrets, and deleted local logs. BeyondTrust is withholding exploit details while self-hosted appliances are still being patched.
Who is affected
The CVE record lists BeyondTrust Remote Support from version 0 through 26.2.3 as affected. Privileged Remote Access shares the code. BeyondTrust says its own testing found no way to exploit PRA, but it still shipped a PRA patch and wants self-hosted customers to apply it.
- Self-hosted Remote Support on 26.2.3 or earlier, especially if the appliance was reachable from the internet between 29 August and the patch.
- Appliances older than 24.3.1, which need an upgrade to a supported release before patch BT26-05-RS can be applied.
- SaaS customers, who BeyondTrust says were patched automatically and need no appliance change.
What to do now
Install BT26-05 on every self-hosted Remote Support appliance, and the matching PRA patch, then treat any internet-exposed box from the August-October window as suspect.
- Apply the patch from the appliance interface if automatic updates are off. Upgrade first if the box is older than 24.3.1.
- Restrict the admin interface to trusted networks and allow outbound traffic only to destinations the appliance actually needs.
- Forward syslog and session events off the box. This actor deletes local logs, so an on-box record is not enough.
- If the appliance was exposed before 8 October, review stored credentials and downstream sessions that started from it. Do not trust local logs alone.
What this means for South African businesses
Most South African SMEs do not run BeyondTrust. MSPs, outsourced help desks, and firms that bought a remote-support appliance do, and those boxes often sit on the internet with a vault of client credentials behind them. A single unpatched appliance is a map of who connects to what, not just one server. If a client still has a self-hosted Remote Support box and nobody can say when it last updated, assume it needs the patch this week and a credential review if it was reachable in September.
Source: BeyondTrust, ARMORY CASTLE and BT26-05.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.