BeyondTrust Remote Support zero-day let ARMORY CASTLE dump the credential vault
CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. Mandiant says the attacker pulled every admin credential from the appliance vault and raised Jump Item roles. CISA added it to KEV on October 16.
BeyondTrust disclosed CVE-2026-102764, a flaw in Remote Support (formerly Bomgar) that lets an unauthenticated remote attacker perform file operations on the appliance, and Google's Mandiant tied its zero-day use to ARMORY CASTLE, the suspected China-nexus group previously tracked as UNC5221. BeyondTrust rates it CVSS 9.3, according to The Hacker News. Self-hosted versions through 26.2.3 are affected and need patch BT26-05-RS; builds older than 24.3.1 must upgrade first. SaaS tenants were patched on October 9. Mandiant says the intruder planted a web shell, created a root SUID backdoor, used the bt-secrets tool to export every administrative credential from the appliance vault, then logged in as an administrator and raised Jump Item and Team roles from "No Access" to "Administrator" to reach downstream systems. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16.
Why it matters
Remote Support is a privileged access broker: it holds the credentials it injects into sessions and decides who may open a session to which machine. Owning the appliance gave the attacker both the vault and the policy, so downstream access looked like normal brokered admin work. This is the same product line as CVE-2024-12356, and our CVE-2026-102764 brief has the full checklist.
Patching does not undo exposure. If a self-hosted appliance ran a vulnerable build, rebuild it from a clean image, then rotate in dependency order: appliance and /login admins, API account secrets, SAML and directory bind accounts, and every vaulted credential it could inject. Compare Jump Item and Team role assignments against a pre-August baseline, and alert on user_changed events that raise a role.
Source: The Hacker News
Related on Start with Identity
- BlogExploited NetScaler SAML zero-day forces a second upgrade after the September patch
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV si
- BlogCisco ISE authentication bypass, CVSS 10, was exploited before the patch
CVE-2026-76460 lets an unauthenticated attacker bypass Cisco Identity Services Engine's management interface through an API endpoint and run commands as root. C
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- CVEIvanti Connect Secure authentication bypass by spoofed header, exploited as a zero-day
One crafted X-DSCGI-PATH header lets an unauthenticated attacker past Ivanti Connect Secure's login and into command execution. Exploited since early October 20
- GlossaryZero Standing Privileges
An access model where no one holds permanent elevated rights; privileges are granted just in time and expire automatically. The strongest form of least privileg
- GlossaryBreak-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a rea