--- title: BeyondTrust Remote Support Zero-Day CVE-2026-102764 Exploited Since August by China-Nexus APT description: CVE-2026-102764, a CVSS 9.3 auth bypass in BeyondTrust Remote Support, was exploited as a zero-day for seven weeks. What happened and what to do now. image: https://blog.openvpn.net/hubfs/blog-images/beyondtrust-zero-day-header-2500.png --- - [Blog](https://blog.openvpn.net) - [Cybersecurity](https://blog.openvpn.net/tag/cybersecurity) # BeyondTrust Remote Support Zero-Day CVE-2026-102764 Exploited Since August by China-Nexus APT Oct 19, 2026 • 4 min read ![An unlocked remote-access appliance with its door ajar and an orange cable carrying data out, wired to the servers behind it](https://blog.openvpn.net/hubfs/blog-images/beyondtrust-zero-day-header-2500.png) Share - - - - By Adam Bullock ## **A Chinese espionage crew lived inside BeyondTrust Remote Support for seven weeks before anyone knew.** On October 15–16, 2026, BeyondTrust disclosed **CVE-2026-102764**, a critical (CVSS **9.3**) authentication-bypass flaw in its Remote Support product that a suspected China-nexus espionage actor had been exploiting as a zero-day since **August 29, 2026** — roughly seven weeks before the vulnerability became public. CISA added it to the [Known Exploited Vulnerabilities (KEV) catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) on **October 16, 2026**. Remote Support is a privileged remote-access tool: it reaches into endpoints and servers to let support staff take control of them. When the front door to that tool can be bypassed without credentials, the attacker inherits exactly the reach the tool was built to provide. That is what happened here. ## What the flaw is The vulnerability is an authentication bypass that lets an *unauthenticated, remote* attacker perform arbitrary file operations on an unpatched appliance. Mandiant and Google Threat Intelligence Group attribute the in-the-wild exploitation to ARMORY CASTLE — an actor also tracked as UNC5221 and WARP PANDA — the same China-nexus cluster repeatedly tied to edge-appliance zero-days. Once in, the operators did not smash and grab. According to the reporting, they: - Escalated to root and deployed the Sawfly webshell and Bareclaw tunneler for persistence and covert access. - Harvested credentials and modified administrator permissions. - Systematically deleted system, web-server, and application logs to erase their tracks. - Exfiltrated internal documents using BeyondTrust's own file-transfer service, then pivoted into downstream systems. ## The identifiers | Field | Detail | | --- | --- | | CVE | CVE-2026-102764 | | Severity | CVSS 9.3 (critical) | | Type | Authentication bypass → unauthenticated arbitrary file operations | | Affected | BeyondTrust Remote Support 24.3.1 through 26.2.3 (Privileged Remote Access shares the affected code) | | Fix | BT26-05-RS patch; SaaS instances patched Oct 8, 2026 | | First exploitation | August 29, 2026 (zero-day) | | Public disclosure | October 15, 2026 | | CISA KEV added | October 16, 2026 | | Attribution | ARMORY CASTLE / UNC5221 / WARP PANDA (China-nexus), per Mandiant + Google Threat Intelligence Group | ## What to do now - **Patch immediately.** Apply BT26-05-RS to any self-hosted Remote Support appliance (24.3.1–26.2.3). SaaS instances were patched on October 8. - **Assume breach if you ran unpatched after late August.** The operators deleted logs and stole credentials, so a clean log is not proof of safety. Rotate credentials that the appliance could touch, and hunt for the Sawfly webshell and Bareclaw tunneler. - **Review downstream trust.** A privileged remote-access tool is only as contained as the accounts and systems it can reach. Check what Remote Support was permitted to do, not just whether it was patched. ![A vault door labeled One Gateway that opens everything, beside a wall of safe-deposit boxes labeled Least Privilege with only one box open](https://blog.openvpn.net/hs-fs/hubfs/blog-images/beyondtrust-zero-day-least-privilege-share.png?width=1200&name=beyondtrust-zero-day-least-privilege-share.png) ## The pattern, not the product This is not a one-off. CVE-2026-102764 is the latest in a months-long run of edge- and access-appliance zero-days — Ivanti Connect Secure, Citrix NetScaler, Cisco, Fortinet, F5, Check Point, SonicWall, Palo Alto GlobalProtect — where the device that grants remote access becomes the thing that's breached. The reason attackers keep winning here is structural: a single internet-facing appliance concentrates authentication, reachability, and trust in one codebase. Patch it late once and an espionage crew lives inside it for weeks. OpenVPN's honest position is not "we're unbreakable." It's vendor diversity and least privilege: - **A vendor-diverse standby.** Running your remote-access layer on independent infrastructure — such as a [self-hosted VPN server](https://openvpn.net/access-server/) like OpenVPN Access Server as a standby — means a critical zero-day in one vendor's appliance does not take your access down with it. When a competitor's gateway is on the KEV clock, a second, differently-sourced path keeps you operating. - **Least-privilege by default.** CloudConnexa's [cloud-delivered ZTNA](https://openvpn.net/cloud-vpn/) segments access so that one compromised path does not open the whole estate. The BeyondTrust operators succeeded partly because a privileged tool had broad downstream reach — [zero trust network access](https://openvpn.net/use-cases/zero-trust-network-access/) and [granular access control](https://openvpn.net/access-server/features/access-control/) narrow that blast radius. The lesson isn't "swap one appliance for another." It's that concentrating all remote access behind a single vendor's internet-facing box is a bet — and this year the house keeps winning. ### Ready to reduce your remote-access blast radius? Try the self-hosted Access Server solution or managed CloudConnexa service for free — no credit card required. [See Which One is Right for You](https://openvpn.net/product-comparison/) ![Adam Bullock](https://blog.openvpn.net/hs-fs/hubfs/adamheadshot.jpg?width=300&height=300&name=adamheadshot.jpg) [Adam Bullock](https://blog.openvpn.net/author/adam-bullock) Adam has loved tech since the days of the dial-up modem. Read his perspective on the OpenVPN blog. ## Related posts from OpenVPN ### Subscribe for Blog Updates ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Adam Bullock", "url" : "https://blog.openvpn.net/author/adam-bullock" }, "dateModified" : "2026-10-19T17:14:32.345Z", "datePublished" : "2026-10-19T17:14:32.000Z", "headline" : "BeyondTrust Remote Support Zero-Day CVE-2026-102764 Exploited Since August by China-Nexus APT", "image" : [ "https://blog.openvpn.net/hubfs/blog-images/beyondtrust-zero-day-header-2500.png" ], "mainEntityOfPage" : { "@id" : "https://blog.openvpn.net/beyondtrust-remote-support-zero-day-cve-2026-102764-exploited-since-august-by-china-nexus-apt", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.openvpn.net/hubfs/Dark=True%20Medium.png" }, "name" : "OpenVPN" } } ```