Key points
- CVE-2026-102764 allows privilege escalation and persistent root access on BeyondTrust appliances.
- Google warns Armory Castle is actively exploiting the flaw for espionage purposes.
- Patches were released on October 8; technical details remain withheld to reduce risk.
BeyondTrust Remote Support instances are vulnerable to a critical flaw that attackers are actively exploiting. The issue affects both software-as-a-service and self-hosted deployments. A patch was released on October 8, 2026. The vendor disclosed the vulnerability publicly on October 15, urging immediate updates. No technical details of the flaw have been released yet.
In plain English
The vulnerability, identified as CVE-2026-102764, carries a CVSS score of 9.3. Attackers can use it to gain elevated privileges on the system. Once inside, they establish long-term access that is difficult to remove. The flaw exists in the remote support appliances themselves. Exploitation grants attackers control over the host system. This allows them to move laterally within the victim’s network.
The background
Google identified the threat actor as Armory Castle, a group aligned with China. The group has been active since October 2023. They targeted a BeyondTrust instance in August 2026. After exploiting the flaw, they deployed a PHP webshell called Sawfly. This tool enables encrypted command and control communication. Attackers then copied a system executable and modified its permissions to gain root access.
What changes now
Google warns that exploitation will likely increase following the public disclosure. Armory Castle and other actors often exploit known vulnerabilities quickly. The group’s tactics are tailored specifically for BeyondTrust systems. They aim to maintain persistent access for intelligence collection. Organizations using this software must verify their patch status immediately. Delaying updates increases the risk of compromise.
Who needs to act first
Teams should prioritize updating systems that face the internet or handle sensitive data. Check whether your deployment is SaaS or self-hosted, as both require attention. Roll out the patch in stages to ensure stability. Test the update in a non-production environment first. Back up configuration files before making changes. If a patch cannot be applied immediately, restrict network access to the appliance to reduce exposure.
What to do and how to stay safe: BeyondTrust
- Verify if your organization uses BeyondTrust Remote Support and check its current version against the patch release.
- Apply the October 8 patch to all SaaS and self-hosted instances as soon as possible.
- Monitor logs for unusual activity, such as unexpected file modifications or new processes running as root.
- Review access controls to ensure only authorized personnel can manage the remote support appliances.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a public exploit for CVE-2026-102764?
No, the vendor is withholding technical details to prevent further exploitation while customers patch.
Which threat actor is exploiting this vulnerability?
Armory Castle, a China-aligned espionage group, has been observed exploiting the flaw.
When was the patch released?
The patch was released on October 8, 2026, for both SaaS and self-hosted customers.
