China-linked group exploited BeyondTrust Remote Support zero-day for seven weeks

A China-linked espionage group exploited CVE-2026-102764 in BeyondTrust Remote Support from August 29 until public disclosure on October 15. Attackers used the PAM appliance's own bt-secrets utility to extract the credential vault and reach every managed system; patch BT26-05 shipped October 8.

• CVE-2026-102764 scores 9.3 on CVSS v4.0 as an authentication bypass by spoofing (CWE-290)
• Exploitation began August 29; disclosure came October 15, patch BT26-05 on October 8
• Attackers extracted the credential vault via bt-secrets and reached all Jump Item endpoints
• Over 1,400 self-hosted Remote Support appliances were internet-reachable at disclosure