Follow BeyondTrust has disclosed CVE-2026-102764, a critical vulnerability in Remote Support (RS) that was exploited as a zero-day by a suspected China-nexus cyber espionage actor. The flaw carries a CVSS 4.0 score of 9.3 and can allow an unauthenticated remote attacker to perform arbitrary file operations on a vulnerable appliance.
Google Threat Intelligence Group and Mandiant attribute the observed exploitation to ARMORY CASTLE, formerly tracked as UNC5221 and also associated with the name WARP PANDA. The group has a history of targeting internet-facing security appliances and exploiting previously unknown vulnerabilities to gain persistent access to high-value environments.
The attacks began as early as August 29, 2026, when the threat actor successfully exploited one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. BeyondTrust later reproduced the vulnerability, developed a fix, and began distributing the BT26-05 patch before publicly disclosing the CVE on October 15, 2026.
Successful exploitation can provide attackers with a foothold on an appliance that brokers privileged remote access and may contain or provide access to administrative credentials, API secrets, support sessions, and internal endpoints. Mandiant observed attackers escalating privileges to root, deploying custom malware, harvesting credentials, modifying access controls, and pivoting into downstream systems.
Organizations can leverage SOC Prime’s AI-Native Detection Intelligence Platform to accelerate threat hunting and detection engineering for emerging vulnerabilities and active exploitation campaigns across SIEM, EDR, XDR, and Data Lake environments.
Prime Architect can also help security teams transform technical threat intelligence into detection logic, hunting queries, and environment-specific rules while supporting faster analysis of newly disclosed attack techniques.
CVE-2026-102764 analysis
CVE-2026-102764 affects BeyondTrust Remote Support versions up to and including 26.2.3. BeyondTrust classifies the issue as improper origin validation in an internal messaging component under CWE-290. The affected components did not sufficiently validate the origin of received messages, allowing a remote attacker, under the right conditions, to perform file operations on the appliance.
The flaw received a CVSS 4.0 score of 9.3 with a network-accessible attack vector, low attack complexity, no required privileges, and no user interaction. Successful exploitation can have a high impact on confidentiality, integrity, and availability.
BeyondTrust is currently withholding the lower-level technical details of the vulnerability while self-hosted organizations complete remediation. However, Mandiant’s incident-response investigation provides substantial insight into how the attackers operated after exploiting the weakness.
ARMORY CASTLE exploited the vulnerability to stage malicious files on BeyondTrust Remote Support appliances. Mandiant observed POST requests targeting an unusual PHP resource before the creation of a custom webshell named SAWFLY in the appliance’s web-accessible directories.
SAWFLY, stored as mangoapi.php, is a lightweight PHP webshell designed to conceal its presence while providing interactive command execution. It uses a custom Base32 communication layer combined with RC4 encryption and only responds when incoming requests contain a specific parameter. Requests that fail this check receive an HTTP 404 response, helping the webshell evade automated crawlers and basic security scanning.
The webshell initially executed under an unprivileged site service account. To gain root access, the attackers copied /bin/sh to /usr/bin/dbus-authd, changed the file owner to root, and enabled the SUID permission bit. Executing this modified binary then provided persistent root-level command execution.
Root access gave ARMORY CASTLE significant control over the BeyondTrust appliance and its privileged-access data. Mandiant observed the actor abusing the legitimate /ns/sbin/bt-secrets administrative utility to attempt to retrieve passwords, API keys, and other credentials stored in the appliance’s native secrets vault.
The attackers also took steps to maintain access across reboots and configuration resets. They created a startup script called zz-root-persist under /home/bomgar/sbin/post_boot.d and modified the appliance’s sudoers template so the compromised service account received passwordless root privileges.
Another custom tool, BARECLAW, was deployed to establish covert tunneling through the compromised device. BARECLAW is a C-based SOCKS5 proxy that operates over WebSockets and can support authentication, traffic obfuscation, destination restrictions, upstream proxying, and TLS.
The attackers modified the appliance’s HAProxy configuration so external requests to a specially chosen WebSocket path were transparently redirected to BARECLAW listening on localhost. This allowed the tunneler to remain hidden from basic external port scanning while still being reachable through the appliance’s legitimate HTTPS-facing infrastructure.
Post-compromise activity extended beyond the appliance itself. ARMORY CASTLE used stolen or modified BeyondTrust administrative permissions to initiate Remote Support sessions against internal endpoints, request file-system access, and download internal documents useful for reconnaissance.
The threat actor also engaged in extensive anti-forensics. Mandiant observed deletion of authentication logs, web server records, application logs, PHP logs, and records associated with credential-vault access. These behaviors underline the importance of forwarding appliance telemetry to an external SIEM or log repository that attackers cannot erase after host-level compromise.
BeyondTrust attributes the activity to ARMORY CASTLE with moderate-to-high confidence, consistent with Mandiant’s assessment. The group has previously exploited vulnerabilities in edge and remote-access products, including Citrix NetScaler and Ivanti Connect Secure, as part of long-term espionage operations.
The current disclosure does not include a public CVE-2026-102764 PoC. BeyondTrust has explicitly withheld exploitation details to reduce the risk of copycat attacks while vulnerable self-hosted appliances remain unpatched.
For CVE-2026-102764 detection, defenders should investigate unusual PHP files, unexpected file creation in web-accessible directories, unexplained SUID binaries, modifications to HAProxy or sudoers templates, suspicious administrator role changes, and interruptions in appliance log forwarding.
CVE-2026-102764 Mitigation
BeyondTrust released the BT26-05 patch to affected customers before coordinated disclosure. As of October 9, 2026, the company had applied the fix to all Remote Support SaaS customer instances. SaaS customers do not need to manually patch the appliance itself.
Self-hosted Remote Support customers running version 24.3.1 through 26.2.3 should immediately install the BT26-05-RS patch through the appliance management interface. Organizations running a version older than 24.3.1 must first upgrade to a supported release before applying the security patch.
Although BeyondTrust has confirmed Remote Support as vulnerable, Privileged Remote Access shares portions of the affected code. The vendor has not identified a successful method for exploiting the issue against PRA but released a corresponding patch as a precaution and recommends that self-hosted PRA customers apply it.
Organizations should consider any internet-accessible Remote Support appliance that remained vulnerable during the exploitation window as potentially compromised until it has been thoroughly investigated. Installing the patch prevents future exploitation but does not remove malware or persistence established before remediation.
Mandiant recommends preserving forensic evidence before rebooting or rebuilding a suspicious appliance. For virtual appliances, this includes capturing memory where possible, taking a snapshot, and exporting the disk. Organizations should also preserve external firewall, WAF, reverse-proxy, and SIEM records covering the entire exposure window.
Confirmed or potentially compromised appliances should be isolated at the perimeter. Organizations may also restrict outbound traffic while maintaining access only to essential BeyondTrust update and licensing infrastructure.
If host-level compromise is confirmed or cannot be ruled out, Mandiant recommends rebuilding the appliance from a clean, fully patched image rather than attempting to remove individual malicious components. Host-level persistence observed in the campaign can survive reboots and configuration resets.
Credential rotation should occur only after the compromised appliance has been patched, isolated, or rebuilt. Otherwise, new credentials may immediately become accessible to an attacker who retains control of the system.
Priority credentials for rotation include appliance administrators, Remote Support administrators, API client secrets, SAML keys, directory-service bind accounts, Remote Support Vault credentials, integration secrets, and credentials entered during potentially compromised support sessions.
To Detect CVE-2026-102764 exploitation, security teams should correlate web requests and file creation events with account changes, support-session activity, unexpected file transfers, suspicious WebSocket connections, and gaps in externally forwarded logging.
Published CVE-2026-102764 IOCs include the SAWFLY webshell filename mangoapi.php with SHA-256 dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb, the BARECLAW binary ingredi_ws with SHA-256 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462, and the staging path app_84304470%2Ephp.
Additional behavioral indicators include creation of /usr/bin/dbus-authd with SUID permissions, the zz-root-persist boot script, suspicious changes to /ns/config/sudoers.template, unexpected modifications to /ns/config/haproxy.conf, and the WebSocket path /uidchanarge.
Security teams should also review BeyondTrust audit events for unexpected increases in Jump Item or Team permissions, newly created API accounts or users, suspicious administrator logins, unexplained file-transfer sessions, and changes to outbound logging destinations.
Because ARMORY CASTLE systematically deleted local logs during the observed intrusion, organizations should not rely exclusively on appliance-resident evidence. Centralized log forwarding, perimeter network telemetry, reverse-proxy logs, and downstream endpoint telemetry are essential for reconstructing potential compromise.
BeyondTrust also recommends restricting access to /login and /appliance interfaces, enforcing phishing-resistant MFA for administrators, minimizing local privileged accounts, limiting API permissions, and applying default-deny outbound filtering where operationally feasible.
SOC Prime’s AI-Native Detection Intelligence Platform can help security teams operationalize the latest threat intelligence around ARMORY CASTLE activity and accelerate behavioral hunting across identity, network, endpoint, and appliance telemetry.
FAQ
What is CVE-2026-102764 and how does it work?
CVE-2026-102764 is a critical vulnerability in BeyondTrust Remote Support caused by inadequate validation of message origins inside an internal messaging component. An unauthenticated remote attacker can abuse the weakness to perform file operations on a vulnerable appliance. In observed attacks, ARMORY CASTLE used the flaw to establish an initial foothold before deploying webshells, escalating privileges, and gaining root-level control.
When was CVE-2026-102764 first discovered?
BeyondTrust observed that ARMORY CASTLE successfully exploited the zero-day on August 29, 2026. The company’s proactive threat hunting identified the activity on September 28, reproduced the vulnerability the same day, and began developing a fix. The patch was released to customers on October 8, SaaS deployments were fully patched by October 9, and coordinated public disclosure occurred on October 15, 2026.
What is the impact of CVE-2026-102764 on systems?
Successful exploitation can enable arbitrary file operations on a BeyondTrust Remote Support appliance and establish a pathway to deeper compromise. In documented attacks, ARMORY CASTLE deployed the SAWFLY webshell, escalated privileges to root, attempted to extract credentials, created persistent administrative access, deployed the BARECLAW tunneler, modified appliance configurations, and pivoted toward internal systems.
Can CVE-2026-102764 still affect me in 2026?
Yes. Self-hosted BeyondTrust Remote Support appliances running version 26.2.3 or earlier remain at risk unless the BT26-05 patch has been applied. Appliances older than 24.3.1 must first be upgraded. SaaS Remote Support instances were patched by BeyondTrust by October 9, 2026.
How can I protect myself from CVE-2026-102764?
Immediately install the BT26-05 patch, investigate appliances that were internet-accessible while vulnerable, preserve external and forensic telemetry, and rebuild systems where compromise is confirmed or cannot be excluded. Rotate privileged credentials only after containment, restrict appliance administration interfaces, enforce MFA, and continue monitoring BeyondTrust guidance for updated details for CVE-2026-102764.
