BeyondTrust Remote Support zero-day let ARMORY CASTLE dump the credential vault
CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. Mandiant says the attacker pulled every admin credential from the appliance vault and raised Jump Item roles. CISA added it to KEV on October 16.
BeyondTrust disclosed CVE-2026-102764, a flaw in Remote Support (formerly Bomgar) that lets an unauthenticated remote attacker perform file operations on the appliance, and Google's Mandiant tied its zero-day use to ARMORY CASTLE, the suspected China-nexus group previously tracked as UNC5221. BeyondTrust rates it CVSS 9.3, according to The Hacker News. Self-hosted versions through 26.2.3 are affected and need patch BT26-05-RS; builds older than 24.3.1 must upgrade first. SaaS tenants were patched on October 9. Mandiant says the intruder planted a web shell, created a root SUID backdoor, used the bt-secrets tool to export every administrative credential from the appliance vault, then logged in as an administrator and raised Jump Item and Team roles from "No Access" to "Administrator" to reach downstream systems. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16.
Why it matters
Remote Support is a privileged access broker: it holds the credentials it injects into sessions and decides who may open a session to which machine. Owning the appliance gave the attacker both the vault and the policy, so downstream access looked like normal brokered admin work. This is the same product line as CVE-2024-12356, and our CVE-2026-102764 brief has the full checklist.
Patching does not undo exposure. If a self-hosted appliance ran a vulnerable build, rebuild it from a clean image, then rotate in dependency order: appliance and /login admins, API account secrets, SAML and directory bind accounts, and every vaulted credential it could inject. Compare Jump Item and Team role assignments against a pre-August baseline, and alert on user_changed events that raise a role.
Source: The Hacker News
Related on Start with Identity
- BlogExploited NetScaler SAML zero-day forces a second upgrade after the September patch
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV si
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogCisco ISE authentication bypass, CVSS 10, was exploited before the patch
CVE-2026-76460 lets an unauthenticated attacker bypass Cisco Identity Services Engine's management interface through an API endpoint and run commands as root. C
- CVEBeyondTrust Remote Support pre-auth command injection, a variant of CVE-2024-12356
An unauthenticated request could run operating system commands on self-hosted BeyondTrust Remote Support and older Privileged Remote Access appliances. Scanning
- CVEZammad session hijack zero-day that led to remote code execution
A session hijack flaw in Zammad 6.3.0 to 6.5.4 gave attackers code execution as the zammad user. It was exploited against DIVD before disclosure. CISA KEV on Oc
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be