UNKNOWN: CVE-2026-102764 (CVSS v4 9.3) affects Remote Support <=26.2.3; insufficient message-origin validation can permit remote file operations. SaaS Remote Support was patched by Oct 9; self-hosted deployments require BT26-05-RS remediation.
حد الدليل: Every vulnerable instance was exploited, widespread campaign scale, or confirmed PRA exploitation.
UNKNOWN: BeyondTrust reports exploitation of one hosted and one self-hosted Remote Support appliance on Aug 29; Mandiant independently confirmed the self-hosted incident. As of Oct 16, BeyondTrust knew only those two impacted customers and had not observed adversary activity since August; PRA shared code but no exploitation path was identified in internal testing.
حد الدليل: Widespread post-disclosure exploitation, confirmed PRA exploitation, or fully independent actor attribution.
UNKNOWN: Mandiant observed ARMORY CASTLE exploit CVE-2026-102764 as a zero-day, deploy SAWFLY and BARECLAW, delete logs, establish host persistence, attempt credential-vault extraction with bt-secrets, elevate administrative/Jump Item permissions, launch downstream remote-support sessions and use native file transfer for internal reconnaissance/data collection.
حد الدليل: Successful theft of every stored credential, universal downstream compromise, or a victim denominator.
UNKNOWN: Canada's Cyber Centre classifies CVE-2026-102764 as Authentication Bypass by Spoofing (CWE-290), notes in-the-wild exploitation and that CISA added it to KEV on Oct 16, and urges remediation of affected Remote Support deployments.
حد الدليل: Victim denominator, actor identity, or downstream credential-compromise breadth.
UNKNOWN: NHS England issued an active-exploitation alert for CVE-2026-102764 and assessed further exploitation as highly likely, urging immediate remediation of affected BeyondTrust Remote Support deployments.
حد الدليل: Observed post-disclosure victim count or successful compromise beyond known incidents.
المتابعة المفتوحة
OPEN [HIGH]: CAMPAIGN_SCALE_POST_DISCLOSURE — No authoritative public denominator establishes widespread exploitation after disclosure; BeyondTrust last named two impacted customers and no observed activity since August.
OPEN [HIGH]: CREDENTIAL_BLAST_RADIUS — Exact credentials successfully extracted, downstream identities/endpoints accessed and data-loss denominator remain incompletely public.
OPEN [MEDIUM-HIGH]: ATTRIBUTION_INDEPENDENCE — ARMORY CASTLE/UNC5221/WARP PANDA attribution is source-qualified but independent public forensic attribution beyond coordinated incident evidence is limited.
Google GTIG / Mandianthttps://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
Canadian Centre for Cyber Securityhttps://www.cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764