BeyondTrust discloses remote support flaw exploited by suspected espionage actor

BeyondTrust disclosed CVE-2026-102764 on October 15, a vulnerability in its Remote Support appliances that allows arbitrary file uploads. Mandiant reported that ARMORY CASTLE, a suspected PRC-linked espionage actor, exploited the flaw before disclosure in late August 2026. Mandiant observed attackers gain root-level control, install persistent access that survived reboots and configuration resets, and change account permissions to reach downstream systems. They used native remote support tools to extract internal documents and attempted to harvest the appliance's credential vault. BeyondTrust has provided security patches. Mandiant urged affected organizations to apply them immediately and warned of potential widespread exploitation following disclosure.