BeyondTrust zero-day CVE-2026-102764 shifts to mass scanning with 2,185 appliances exposed online

Exploitation of CVE-2026-102764, a critical vulnerability in BeyondTrust Remote Support edge appliances, is crossing the line from a narrow espionage operation into indiscriminate, automated attack activity. Internet-wide measurement showing 2,185 matching appliances reachable on the public internet gives that shift a measurable denominator.

A critical flaw in an internet-facing product

The National Vulnerability Database published its record for the bug on 2026-10-15. It describes the flaw as insufficient checking of where messages handled by the appliance's internal components originate, which allows an attacker to carry out file operations on the device. NVD classifies it as authentication bypass through spoofing (CWE-290) and rates it 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0, with a network attack vector that requires no privileges and no user interaction.

BeyondTrust addressed the issue in advisory BT26-05, which states that a patch is available and lists several mitigations.

An espionage campaign came first

According to reporting by The Record, the flaw was used in an espionage campaign attributed by Mandiant and Google's Threat Intelligence Group to a cluster tracked as Armory Castle, also known as UNC5221. The group has operated since October 2023 and previously exploited zero-days in Ivanti and Citrix edge products.

The timeline reported by The Record shows attackers were active long before disclosure: Mandiant traced the first attacks to 29 August, and BeyondTrust learned of the problem on 27 September, after an unrelated vendor's edge-appliance compromise became public. Mandiant reportedly observed privilege escalation, lateral movement and durable access inside victim networks, supported by custom tooling named Sawfly and Bareclaw. Two findings matter most for defenders: the actor reportedly extracted every credential stored on compromised appliances, and made file changes that remain in place even after a reboot or a configuration reset.

From chosen targets to opportunistic scanning

Google's Threat Intelligence Group has warned, per The Record, that this actor historically switches to widespread opportunistic exploitation once a flaw becomes public, racing to reach unpatched devices — a pattern it previously followed with Ivanti and Citrix flaws. An analysis of the transition published on dev.to lists three signals that mark this shift on a specific appliance: bursts of failed authentication attempts, which point to automated probing rather than a chosen target; requests hitting endpoints reachable only through the vulnerable code path, which indicate exploit attempts; and unexpected outbound connections from the appliance, which suggest post-exploitation activity.

What the exposure count does and does not say

A ZoomEye search for the product's long-standing Bomgar fingerprint returned 2,185 matching assets on 2026-10-26. That figure needs careful reading. It counts devices that answered a scan and match the product fingerprint — not devices confirmed vulnerable, and not devices confirmed compromised, since banners rarely expose version information. Query choice also matters: a dev.to analysis notes that a broader search for pages titled "Remote Support" returns over 863,000 matches, most of which are unrelated web pages and useless for prioritisation.

The count is best used as a baseline. The same analysis suggests repeating an identical query over time to see whether an organisation's own footprint and the global population shrink as patching progresses; the trend says more than any single snapshot.

Patching alone does not close the incident

Because the attackers reportedly harvested all stored credentials, every system the appliance could reach is in scope for credential rotation regardless of patch status. Because the file changes reportedly survive resets, a patched appliance may still be running tampered components. The recommended sequence is to apply the patch or vendor mitigation, confirm it took effect on the appliance itself, verify the running build against a known-good image, rotate every credential the device could have held, and — following Mandiant's guidance — treat any vulnerable internet-facing appliance as potentially compromised until it has been reviewed. Where a device cannot be restored to a trusted state, replacement is the only safe option.

Why it matters

CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on 2026-10-16 with a remediation deadline of 2026-10-19 and mandatory forensic triage under BOD 26-04; the ransomware connection is listed as unknown. Remote support appliances are internet-reachable by design and are often purchased by IT operations rather than the security team, so they frequently sit outside the asset register that drives patching. The interval between targeted and opportunistic exploitation is precisely when unpatched devices get swept up wholesale, and the 2,185-asset count shows how large that surface still is. Organisations running these appliances should inventory their estate now, reconcile it against external scans, and assume compromise rather than hope that a restart or a patch alone cleaned the box.