A Chinese APT has been exploiting a BeyondTrust vulnerability as a zero-day since August as part of its state-sponsored espionage operations.
The exploited flaw, tracked as CVE-2026-102764 (CVSS score of 9.3), is described as an improper validation of message origins that could allow attackers to perform file operations on Remote Support (RS) appliances.
According to BeyondTrust, all RS versions up to and including 26.2.3 are affected. Fixes for the bug were included in the BT26-05-RS patch for versions 24.3.1 through 26.2.3. Customers on releases older than 24.3.1 should upgrade to a newer version and then apply the patch.
BeyondTrust identified the security defect on September 28, one day after its exploitation against a security device provider became public. However, initial exploitation occurred on August 29, against one BeyondTrust-hosted and one self-hosted RS appliance.
The company says it produced a patch by September 30, but took its time to test it and resolve additional exploitation paths before shipping the fix on October 8.
“As of Oct 9, 2026, a patch that remediates this vulnerability has been applied to all Remote Support SaaS customers,” BeyondTrust says, noting that self-hosted customers should manually apply the fix if they do not have automatic updates.
According to Mandiant and Google Threat Intelligence Group (GTIG), CVE-2026-102764 has been exploited as a zero-day by Armory Castle, a China-linked threat actor also tracked as UNC5221 and Warp Panda.
Armory Castle is a state-sponsored espionage group focused on long-term intelligence gathering and is known for targeting SaaS providers, tech companies, government entities, legal services, and business-process outsourcers.