What happened
BeyondTrust disclosed CVE-2026-102764 on October 14, a CVSS 9.3 authentication bypass in Privileged Remote Access (PRA). Within 48 hours of disclosure, CISA added it to the Known Exploited Vulnerabilities catalog with an FCEB patch deadline of October 19. That deadline has now passed. China-nexus threat actor ARMORY CASTLE is actively exploiting this vulnerability in campaigns targeting US federal agencies and defense contractors.
The vulnerability
CVE-2026-102764 is an authentication bypass in the BeyondTrust PRA web interface. An unauthenticated attacker with network access to the PRA console can bypass the login gate and retrieve credentials stored in the vault. Credentials at risk include domain admin accounts, service accounts, and privileged SSH keys. No credentials are required. No user interaction is required.
- Affected: BeyondTrust PRA 23.3 and earlier
- Fixed in: PRA 23.4 and later
- CVSS: 9.3 (Critical). Attack vector: Network. Authentication: None. Complexity: Low.
- FCEB deadline: October 19, 2026 (now overdue for federal agencies)
ARMORY CASTLE: what we know about this threat actor
ARMORY CASTLE is a China-nexus threat actor with a track record of targeting privileged access management tools and credential stores. The group specializes in long-dwell-time access, preferring to establish persistent presence using legitimate credentials rather than deploying noisy malware. Stealing vault credentials is a force multiplier: it gives the actor the same access level as the legitimate administrator, making detection significantly harder. This group has been observed targeting defense industrial base and federal civilian executive branch targets.
What to do now
- Patch immediately: upgrade BeyondTrust PRA to 23.4 or later. If you cannot patch, take the PRA web console off internet-facing access immediately.
- Rotate all credentials in the vault. Assume any credential stored in PRA 23.3 or earlier has been exfiltrated if your instance was internet-accessible.
- Review PRA access logs for unauthenticated vault queries. IOCs are circulating on VX-Underground and Bleeping Computer.
- Check for new privileged account creations or unusual service account logins in the 30-day window prior to patching.
- Report confirmed exploitation to CISA at report.cisa.gov and to your ISSO or ISSM if you are a federal agency.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are responding to active BeyondTrust exploitation or need help with credential vault hardening.