The attacker got in on 29 August. The fix came 40 days later, on 8 October. The disclosure, seven days after that.
That is how BeyondTrust itself lays it out. On 29 August the group used a zero-day against one Remote Support instance hosted by the company and one self-hosted appliance. The traces were found on 28 September in a threat hunt, and the cloud instance was contained within 27 minutes of first detection.
Fact
The facts: on 15 October 2026 BeyondTrust published security advisory BT26-05 and CVE-2026-102764 for a critical vulnerability in Remote Support. Per the NVD description, the components did not adequately validate the origin of the messages they received, and under the right conditions this could allow an attacker to perform file operations on the appliance. BeyondTrust gives it 9.3 on CVSS-B (critical); NVD lists affected Remote Support versions up to and including 26.2.3. Per the advisory, the fix is the BT26-05-RS patch for versions 24.3.1 through 26.2.3; anyone on a version older than 24.3.1 must first upgrade to a newer version. According to BeyondTrust, a suspected China-nexus espionage actor exploited a zero-day on 29 August against one company-hosted instance and one self-hosted appliance. On 28 September the company contained the cloud instance, on 8 October it released the BT26-05 patch (cloud instances were patched automatically), and on 15 October it made a coordinated disclosure. The company knows of only the two impacted customers and has not seen adversary activity since August. It assesses with moderate to high confidence that this is the actor Google Threat Intelligence Group and Mandiant track as UNC5221 (now ARMORY CASTLE), and CrowdStrike tracks as WARP PANDA. Its internal testing found no way to attack Privileged Remote Access, but the code is shared and a patch exists for it too. Technical details are being withheld while appliances are patched. On 16 October CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog with a deadline of 19 October for US federal civilian agencies. Under directive BOD 26-04, the catalog also requires a forensic triage to check whether the system is already compromised.
The group saves a zero-day for chosen targets. Once the flaw is public, according to BeyondTrust, it typically moves to broad exploitation of every unpatched instance. Mandiant, again by BeyondTrust's account, warns defenders to expect the same here.
While the flaw is secret, the attacker picks targets. Once it is public, every unpatched instance is one.
BeyondTrust also admits an uncomfortable detail about its own defenses. By its account the sensors fired when the attacker escalated privileges, but the automated triage in a third-party vendor's platform closed the alerts as false positives. Anyone who has worked a door knows why there's a filter in front of the alarm: otherwise it rings for everything. Here the filter threw out the real one.
Mandiant published its own analysis the same day. I don't retell it here, because I haven't opened it. Who the two customers are and how exactly the attack works, BeyondTrust doesn't say either.
BT26-05 is the first job today for anyone running Remote Support or Privileged Remote Access on their own server; cloud instances are already patched. Then the logs. Send them off the appliance, because according to BeyondTrust the group deletes the local ones and the copy off the box is often the only one left.
Sources
BeyondTrust - ARMORY CASTLE and BT26-05 (CVE-2026-102764), 15.10.2026BeyondTrust - security advisory BT26-05, Trust CenterNVD - CVE-2026-102764CISA KEV (CVE-2026-102764)The visual is generated code-art, no third-party images.