# BeyondTrust Patches Exploited Zero-Day

A suspected China-backed threat group began exploiting BeyondTrust Remote Support vulnerability CVE-2026-102764 on August 29, 2026. BeyondTrust detected and contained a known intrusion on September 28, then released a patch for self-hosted deployments and an update for cloud customers on October 8. Government agencies and contractors using the product should verify that the applicable fix has been applied and investigate for signs of compromise dating from before disclosure; researchers warn that broader exploitation may follow.

- The vulnerability was exploited before a fix was available, making patch status and review of earlier activity relevant to organizations operating BeyondTrust Remote Support.
- Agencies and contractors should confirm whether their deployments are self-hosted or cloud-based, apply the corresponding October 8 fix, and investigate for activity dating back to August 29.
- The signals identify no contract award, solicitation, or procurement requirement; the immediate relevance is operational cybersecurity risk for organizations managing the affected product.

**Jurisdictions:** federal, international
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 16, 2026

### Vendors
- BeyondTrust ()

### Sources
- [Prolific Chinese espionage group exploits BeyondTrust zero-day | CyberScoop](https://cyberscoop.com/china-espionage-attacks-beyondtrust-zero-day-armory-castle) - CyberScoop
- [BeyondTrust patches zero-day exploited in attacks since August](https://www.reddit.com/r/cybersecurity/comments/1x7gh7n/beyondtrust_patches_zeroday_exploited_in_attacks) - reddit-cybersecurity