Loading vulnerability…
CVE-2026-102764 is an origin-validation vulnerability in internal components of BeyondTrust Remote Support appliances. The components inadequately validate the origin of received messages, allowing an attacker under certain conditions to perform file operations, including arbitrary file uploads, on the appliance. BeyondTrust disclosed the vulnerability on October 15, 2026. ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221, exploited it as a zero-day in late August 2026.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical improper origin validation vulnerability in BeyondTrust Remote Support, rated CVSS 9.3, allows remote attackers to perform file operations on an affected appliance. Armory Castle exploited it for initial compromise, followed by web-shell deployment, privilege escalation, credential theft, persistence, lateral movement, and document exfiltration. Self-hosted versions 24.3.1 through 26.2.3 require patch BT26-05-RS; older versions must first be upgraded. SaaS customers were patched by October 9, 2026.
A critical authentication bypass in BeyondTrust Remote Support, exploited as a zero-day since late August 2026. Armory Castle used it for initial access, subsequently obtaining root privileges, deploying Sawfly and Bareclaw, accessing credentials, and moving laterally. BeyondTrust patched SaaS customers on October 8; self-hosted deployments require updates if automatic updates are disabled.
Insufficient validation of message origins in internal components of BeyondTrust Remote Support could allow an attacker to perform file operations on the appliance under certain conditions. The advisory does not specify affected versions, attack prerequisites, or the scope of permitted file operations.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.