# BeyondTrust Remote Support zero-day let ARMORY CASTLE dump the credential vault

Source: https://startwithidentity.com/blog/2026-10-15-beyondtrust-remote-support-zero-day-let-armory-castle-dump-the-credential-vault/
Last updated: 2026-10-15
License: content by Start with Identity. Cite the source URL.

---

[BeyondTrust](https://startwithidentity.com/vendors/pam/beyondtrust/) disclosed CVE-2026-102764, a flaw in Remote Support (formerly Bomgar) that lets an unauthenticated remote attacker perform file operations on the appliance, and Google's Mandiant tied its zero-day use to ARMORY CASTLE, the suspected China-nexus group previously tracked as UNC5221. BeyondTrust rates it CVSS 9.3, according to The Hacker News. Self-hosted versions through 26.2.3 are affected and need patch BT26-05-RS; builds older than 24.3.1 must upgrade first. SaaS tenants were patched on October 9. Mandiant says the intruder planted a web shell, created a root SUID backdoor, used the `bt-secrets` tool to export every administrative credential from the appliance vault, then logged in as an administrator and raised Jump Item and Team roles from "No Access" to "Administrator" to reach downstream systems. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16.

## Why it matters

Remote Support is a [privileged access](https://startwithidentity.com/guides/fundamentals/what-is-pam/) broker: it holds the credentials it injects into sessions and decides who may open a session to which machine. Owning the appliance gave the attacker both the vault and the policy, so downstream access looked like normal brokered admin work. This is the same product line as [CVE-2024-12356](https://startwithidentity.com/cves/cve-2024-12356/), and our [CVE-2026-102764 brief](https://startwithidentity.com/cves/cve-2026-102764/) has the full checklist.

Patching does not undo exposure. If a self-hosted appliance ran a vulnerable build, rebuild it from a clean image, then rotate in dependency order: appliance and `/login` admins, API account secrets, SAML and directory bind accounts, and every vaulted credential it could inject. Compare Jump Item and Team role assignments against a pre-August baseline, and alert on `user_changed` events that raise a role.

Source: [The Hacker News](https://thehackernews.com/2026/10/china-linked-hackers-exploited.html)