BeyondTrust appliance bug turned support into a foothold
Mandiant says ARMORY CASTLE exploited CVE-2026-102764 in BeyondTrust Remote Support appliances as a zero-day in late August 2026, then used the access to stay inside compromised devices. BeyondTrust disclosed the flaw on October 15 and Mandiant released detection guidance alongside its findings.
The bug lets an attacker upload files to the appliance itself. On a box that brokers remote support and is trusted deep inside the network, that means the attacker can hide tooling on the appliance, keep coming back, and use it as a relay into other systems instead of treating it like a single broken server.
For organizations that rely on remote-support or RMM tools, the exposure is not limited to the appliance image on disk: a compromise can convert a vendor-trusted admin channel into a persistent beachhead in the customer environment. The question after patching is what that box already touched and whether its logs still show the intrusion path.
ARMORY CASTLE Exploits BeyondTrust | Google Cloud Blog
ARMORY CASTLE exploited zero day vulnerabilities in BeyondTrust Remote Support appliances to establish persistent, stealthy access to compromised devices