BEYONDTRUST REMOTE SUPPORT 26.2.3 SUFFERS AUTH BYPASS CVE-2026-102764

Summary from the TLDR InfoSec newsletter

BeyondTrust Remote Support versions 26.2.3 and earlier are affected by CVE-2026-102764, a critical authentication bypass and arbitrary file upload vulnerability with a CVSS score of 9.3. CVE-2026-102764 lets unauthenticated attackers perform file operations, escalate to root, and access credential vaults. A suspected Chinese state-sponsored espionage group, Armory Castle (UNC5221), has actively exploited this zero-day flaw since late August to deploy custom webshells such as BARECLAW for persistence and lateral movement. BeyondTrust released security patches in October for self-hosted customers, prompting CISA and the Canadian Centre for Cyber Security to advise organizations to restrict external access to appliances and conduct forensic reviews for signs of compromise.