BeyondTrust advisory BT26-05 (published Oct 15) covers CVE-2026-102764, an unauthenticated improper-origin-validation flaw (CWE-290) in an internal messaging component of Remote Support that lets a remote attacker perform file operations on the appliance. All versions through 26.2.3 are affected; the BT26-05-RS patch covers 24.3.1 to 26.2.3, and older versions must upgrade first. SaaS instances were patched automatically (BeyondTrust says Oct 8–9). BeyondTrust and Mandiant say a suspected PRC-nexus espionage actor, ARMORY CASTLE (formerly UNC5221; CrowdStrike's WARP PANDA), exploited it as a zero-day starting Aug 29 against one BeyondTrust-hosted and one self-hosted instance. Privileged Remote Access shares the code, so BeyondTrust also shipped the patch for PRA. Mandiant warns to expect broad exploitation now that the bug is public, and says any internet-reachable vulnerable appliance should be treated as potentially compromised until reviewed. Not yet on CISA KEV as of the Oct 15 catalog. Update Oct 16: CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities catalog on Oct 16 with a federal due date of Oct 19 and flagged it for forensic triage, so agencies must look for compromise as well as patch.