CVE-2026-102764: BeyondTrust Remote Support Zero-Day

BeyondTrust disclosed CVE-2026-102764 on October 15, 2026. It is a critical flaw in Remote Support that lets a remote attacker perform file operations on the appliance, and by the time the advisory went public it had already been used against real customers for about seven weeks. Google's Mandiant team ties the activity to ARMORY CASTLE, a suspected China-nexus espionage cluster that was previously tracked as UNC5221 (CrowdStrike calls it WARP PANDA). CISA added the flaw to the Known Exploited Vulnerabilities catalog on October 16, and federal agencies have until October 19 to patch.

This post covers what the flaw does, what the attackers did after getting in, who needs to act, and why the timeline matters more than the score.

What the flaw is and how it was used

BeyondTrust describes the root cause as improper origin validation in an internal messaging component of Remote Support. The component did not properly check where the messages it received came from, which let a remote attacker carry out file operations on the appliance. The CVSS 4.0 vector rates it network-reachable, low complexity, no privileges and no user interaction. Mandiant goes a step further and describes it as an unauthenticated arbitrary file upload. BeyondTrust has deliberately kept deeper technical detail back while self-hosted appliances are still being patched.

Mandiant's incident response work shows what the attackers did with it:

Foothold. POST requests to a staging PHP file were followed, about 11 minutes later, by a PHP webshell called SAWFLY dropped into the appliance's web directory. SAWFLY wraps its command channel in Base32 and RC4 and only answers requests that carry a specific parameter, returning a 404 to everyone else.
Root. The attacker copied the system shell to a file named dbus-authd, set root ownership and the SUID bit, which gave them root on the host under a name that looks like a normal system service.
Credentials. They ran the appliance's own secrets utility against the vault to pull stored credentials, then removed its log file.
Persistence. A script in the post-boot directory appended a passwordless sudo rule for the site service account to the sudoers template, so the access survived restarts.
Lateral movement. With admin credentials they logged in to the web portal, raised Jump Item and Team permissions from No Access to Administrator, and used remote support sessions to reach internal endpoints and copy documents out.
Tunnel and cleanup. A custom SOCKS5 proxy called BARECLAW, running over WebSocket, was made reachable from the internet through a modified haproxy configuration. Authentication, system, web server and application logs were then deleted.

Who is affected

The advisory (BT26-05) lists Remote Support, all versions up to and including 26.2.3. The fix ships as the BT26-05-RS patch, which covers versions 24.3.1 through 26.2.3. Customers on anything older than 24.3.1 have to upgrade first, and Mandiant points out that upgrading does not undo any compromise that already happened.

SaaS customers are already covered: BeyondTrust says the patch has been applied to all Remote Support SaaS instances. Self-hosted appliances are the open exposure. Unless an appliance is subscribed to automatic updates, the patch has to be applied by hand from the appliance interface.

Privileged Remote Access needs a note of its own. The advisory names only Remote Support, but BeyondTrust's blog says PRA shares the affected code. Its internal testing found no way to exploit the flaw in PRA, yet a patch was released anyway and self-hosted PRA customers are told to apply it right away. Treat PRA as in scope for patching even though the advisory table does not list it.

On victim counts, the sources do not fully agree. BeyondTrust and SecurityWeek describe two known customers hit on August 29, one on a BeyondTrust-hosted instance and one self-hosted. One of the write-ups listed in the references mentions only a single self-hosted appliance. BeyondTrust says it has seen no adversary activity since August, while Mandiant warns that exploitation could become widespread now that the flaw is public.

Forty-seven days of quiet

The number worth remembering in this case is 47. The first exploitation happened on August 29. BeyondTrust's own timeline says it only started hunting on September 27, after another security device vendor's compromise became public, and it contained the first customer it found on September 28. A patch was validated on September 30, released on October 8, and the advisory followed on October 15. That is 47 days between the first intrusion and public disclosure, with customers unaware for most of it.

Detection was not missing so much as ignored. BeyondTrust says its sensors fired in real time during the intrusion, but a third-party triage tool closed those alerts as false positives. A tool that automatically dismisses the alert is as good as having no alert, and the vendor's own monitoring is not a substitute for monitoring you run yourself.

The second pattern is the target choice. SecurityWeek lists earlier edge and remote access flaws tied to the same cluster, including Ivanti CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282, plus Dell RecoverPoint CVE-2026-22769. The common thread is a product that sits at the network boundary and holds credentials or sessions into everything behind it. A remote support appliance fits that description exactly: whoever controls it can open sessions on the machines it manages.

That is also why the score understates the risk. VulnTracker shows an EPSS of 0.6% for this CVE, a low probability of broad exploitation, while the flaw is already confirmed in real intrusions and in KEV. A model built on observed mass exploitation lags behind a targeted campaign that deliberately stays small.

Reading it on VulnTracker

On the CVE-2026-102764 page, the scores point in the same direction but come from two different systems. BeyondTrust rates the flaw 9.3 under CVSS 4.0, and the NVD score shown on VulnTracker is 9.8 under CVSS 3.1. Both are critical, and both reflect no authentication and no user interaction. Do not compare the two numbers directly, because the scales differ.

The EPSS value of 0.6% is the one that looks out of place next to a KEV listing. KEV is the stronger signal here: the flaw was added on October 16 with a federal due date of October 19, which tells you exploitation is confirmed, not predicted. The affected version is listed as 26.2.3 and below. The weakness type is CWE-290, which MITRE catalogs as authentication bypass by spoofing, although the advisory's own wording of improper origin validation is closer to a different entry. Use the CWE as a loose label and the advisory text as the real description.

What to do now

Patching is the first step, but because exploitation started in August, patching alone is not enough for a self-hosted appliance that was reachable from the internet.

Apply the BT26-05-RS patch. Upgrade first if you run a version older than 24.3.1. Self-hosted Privileged Remote Access customers should apply the PRA patch as well.
Reduce exposure. Restrict the /login and /appliance interfaces by IP, put SAML with phishing-resistant MFA in front of the portal, set the default Jump Item role to No Access, and limit egress from the appliance.
Send logs off the box. Forward syslog and session events to your SIEM over TLS in near real time, since the attackers deleted local logs.
Hunt for what Mandiant saw. Look for privileged sessions from residential or VPN address space you do not recognize, unfamiliar .php files in web directories, user_changed events that raise Jump Item or Team roles, unexpected WebSocket upgrades, gaps in log forwarding, a SUID file named dbus-authd, and edits to the haproxy configuration.
Preserve evidence before you change anything. Snapshot the VM with memory or image the physical appliance. BeyondTrust asks customers to open a Sev 1 request citing BT26-05.
If you find signs of compromise, rebuild. Isolate the appliance, rebuild it from a known-good state, patch it, and only then rotate every credential the appliance brokers. Mandiant advises against cleaning in place.

For matching on disk, Mandiant publishes SHA-256 hashes for two files: SAWFLY (mangoapi.php) is dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb and BARECLAW (ingredi_ws) is 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462. The report also includes YARA rules named G_Hunting_Webshell_SAWFLY_1 and G_Hunting_Backdoor_BARECLAW_1.

Takeaway

CVE-2026-102764 is a reminder that the dangerous window for an edge appliance often closes before anyone outside the vendor knows it opened. If your Remote Support or Privileged Remote Access appliance is self-hosted, patch it today, then check its logs back to late August rather than assuming a clean bill of health. If you want to know whether this CVE, or other flaws in the remote access and edge products you run, affect your stack, you can track it on VulnTracker and see KEV status, scores and affected versions in one place.