A Vulnerability in BeyondTrust Remote Support Could Allow for Arbitrary Upload of Files

A vulnerability has been discovered in BeyondTrust Remote Support that could allow for arbitrary upload of files. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints. Successful exploitation of this vulnerability could allow a remote attacker to perform file operations on an affected appliance.

Mandiant identified evidence that ARMORY CASTLE, a suspected PRC-nexus espionage threat actor (formerly tracked as UNC5221), exploited this vulnerability as a zero-day, in late August 2026. Following the successful exploitation of CVE-2026-102764, Mandiant observed ARMORY CASTLE leverage multiple distinct Tactics, Techniques, and Procedures (TTPs) to establish a foothold, escalate privileges, and enable lateral movement. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026.

A vulnerability has been discovered in BeyondTrust Remote Support that could allow for arbitrary upload of files. Details of this vulnerability are as follows:

Tactic:Initial Access(TA0001):

Technique:Exploit Public-Facing Application(T1190):

According to BeyondTrust, the Remote Support version that is offered through their Software-as-a-Service (Saas) infrastructure has already been patched for this vulnerability. Self-hosted deployments of Remote Support will need to manually apply the patch provided by BeyondTrust.

Successful exploitation of this vulnerability could allow a remote attacker to perform file operations on an affected appliance.

We recommend the following actions be taken:

Copyright©2026 Center for Internet Security®