Actively Exploited BeyondTrust Remote Support Zero-Day (CVE-2026-102764) Leads to Full Root Compromise

BeyondTrust and Mandiant warned organizations of active zero-day exploitation targeting a critical vulnerability (CVE-2026-102764, CVSS 9.3) in self-hosted BeyondTrust Remote Support appliances running version 26.2.3 and earlier.

The flaw stems from internal components failing to validate message origins, enabling an unauthenticated remote attacker to perform arbitrary file operations and gain full root control over the host appliance. Mandiant attributed the zero-day attacks—dating back to late August 2026—to the espionage group ARMORY CASTLE (formerly UNC5221). CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, urging administrators to apply the BT26-05-RS patch, audit appliances for persistence, and rotate all brokered credentials.