BeyondTrust Remote Support zero-day used to dump the appliance credential vault

CVE-2026-102764, an improper origin validation flaw in self-hosted BeyondTrust Remote Support, was exploited as a zero-day from August 29, 2026 by the China-nexus group Armory Castle. Google Threat Intelligence and Mandiant reported the attacker tried to harvest credentials from the appliance's secrets database, targeted configuration templates for passwordless root on the site service account, and used compromised administrator credentials to open remote sessions to downstream systems and exfiltrate documents. CISA added it to its Known Exploited Vulnerabilities catalog on October 16.

Victim

Multiple: self-hosted BeyondTrust Remote Support appliances

Industry

Technology

Country

Global

Intrusion began

Aug 29, 2026

First disclosed

Oct 15, 2026

Actor

Armory Castle (previously tracked as UNC5221), China-nexus, per Google Threat Intelligence and Mandiant reporting (Nation-state)

Initial access

Identity infrastructure vulnerability

Identity control that failed

Credential storage

MFA

Not applicable (no interactive login)

Abused identity

Human account

Records affected

Not disclosed

Disclosed cost

Not disclosed