critical Cve 2026 102764 · Exploits

BeyondTrust Remote Support Zero-Day CVE-2026-102764 Exploited Since August

Data graphic: CVE-2026-102764, 9.3 Critical under CVSS v4.0 CNA-assigned , exploited before the patch.

Alex Kim
Threat intelligence editor · Published Oct 16, 2026, 7:11 PM EDT

Google says China-nexus ARMORY CASTLE exploited BeyondTrust Remote Support CVE-2026-102764 (CVSS 9.3) from August. Patch self-hosted appliances and hunt for SAWFLY.

A critical flaw in BeyondTrust Remote Support (RS), tracked as CVE-2026-102764, was exploited as a zero-day from late August 2026 by a suspected China-nexus espionage actor. Google Threat Intelligence Group (GTIG) and Mandiant call the actor ARMORY CASTLE, formerly UNC5221. Every self-hosted RS appliance on version 26.2.3 or earlier that has not applied the BT26-05-RS patch is affected. BeyondTrust and Mandiant disclosed the flaw together on 15 October 2026.

What is affected

BeyondTrust's advisory BT26-05 rates the flaw 9.3 (Critical) under CVSS v4.0, vector AV:N/AC:L/AT:N/PR:N/UI:N, with high impact on confidentiality, integrity and availability. It maps to CWE-290. The vendor describes it as improper origin validation in an internal messaging component: the component did not adequately validate where messages came from, which, "under the right conditions", lets a remote attacker perform file operations on the appliance.

Affected: Remote Support, all versions up to and including 26.2.3.
Fixed: the BT26-05-RS patch for versions 24.3.1 through 26.2.3. Versions older than 24.3.1 must upgrade first.
SaaS: patched automatically. The advisory says the patch was applied to all SaaS customers as of 9 October. The vendor blog says the patch shipped on 8 October.
Privileged Remote Access (PRA) shares the affected code. BeyondTrust found no way to exploit it there, but released the patch for PRA as a precaution.

BeyondTrust is withholding technical details of the bug while self-hosted appliances are patched. We therefore cannot describe the exact request path. GTIG describes the outcome as unauthenticated file operations leading to host-level control and access to credentials the appliance stores or brokers.

Status in public databases

As of 16 October (KEV catalog version 2026.10.15) the NVD record, published 15 October, has status "Received" and carries only the CNA-supplied score; NVD has not analyzed it. The CVE does not appear in CISA's Known Exploited Vulnerabilities feed, despite confirmed exploitation. Expect both to change.

Exploitation timeline

29 August: the actor exploits the zero-day against one BeyondTrust-hosted RS instance and one self-hosted appliance.
28 September: BeyondTrust threat hunting finds the hosted instance and contains it within 27 minutes of the compromise being identified.
30 September: Mandiant shares findings from the self-hosted customer.
8 October: patch released.
15 October: coordinated disclosure.

BeyondTrust says its sensors fired when the actor escalated privileges, but an automated triage tool in a third-party detection platform closed the alerts as false positives.

Data graphic: timeline of CVE-2026-102764 from first exploitation on 29 Aug to the BT26-05-RS patch on 8 Oct and disclosure on 15 Oct.

Exploitation began 29 Aug; patch BT26-05-RS shipped 8 Oct; coordinated disclosure 15 Oct.

Malware: SAWFLY and BARECLAW

SAWFLY is an obfuscated PHP webshell, seen as mangoapi.php, dropped about 11 minutes after initial exploitation. It uses a custom Base32 layer with an RC4 stream cipher, returns HTTP 404 unless a specific obfuscated parameter is present, and runs decrypted payloads through @eval(). SHA-256: dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb.

BARECLAW is a C SOCKS5 tunneler (ingredi_ws) using WebSocket transport, an embedded CivetWeb server, OpenSSL and optional XOR obfuscation. It listens on TCP 19800 with the WebSocket path /uidchanarge. The actor edited /ns/config/haproxy.conf to route that path to the local listener, so the tunnel is reachable through the appliance's normal web port. SHA-256: 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462.

A staging webshell named app_84304470%2Ephp is also listed. GTIG published YARA rules for both families.

After the foothold: what the actor did

GTIG's write-up of the self-hosted intrusion gives concrete host-level traces to look for. Customers cannot normally inspect the appliance file system, so these matter mostly to BeyondTrust support and to anyone with a forensic image.

Root escalation: SAWFLY ran as the site's unprivileged service account. The actor copied /bin/sh to /usr/bin/dbus-authd to get a SUID root shell.
Persistence: a script, /home/bomgar/sbin/post_boot.d/zz-root-persist, appends %SITE_SERVICE_ACCOUNT% ALL=(ALL) NOPASSWD: ALL to /ns/config/sudoers.template and runs bt-sysconfig --no-restart misc to rebuild the live sudoers file. GTIG says this survives reboots and configuration resets.
Credentials: the actor ran /ns/sbin/bt-secrets get … vault against the appliance's secrets store, then deleted /home/bomgar/log/bt-secrets.log and its archives.
Inside the application: the actor logged in to the web admin portal with compromised Administrator credentials, then raised a compromised account's Jump Item and Team roles from No Access to Administrator, giving standing authority to start remote sessions on downstream systems. Audit events show these as user_changed entries.
Collection: the actor used RS's own file-transfer service to pull internal documents, such as software inventories, from a user's desktop.

Attribution

GTIG attributes the exploitation and malware deployment to "the suspected PRC-nexus espionage actor ARMORY CASTLE". BeyondTrust separately assesses "with moderate to high confidence" that the activity belongs to the cluster Mandiant tracked as UNC5221, which CrowdStrike calls WARP PANDA, based on tradecraft. GTIG says the tooling and tradecraft align with previously observed activity from that cluster.

The same actor has a record with edge appliances. BeyondTrust's blog lists earlier zero-days in Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282). BeyondTrust's own RS and PRA products are also a repeat target for attackers generally: CISA's KEV catalog already lists three earlier exploited flaws in them, CVE-2024-12356 (added 19 December 2024), CVE-2024-12686 (13 January 2025) and CVE-2026-1731 (13 February 2026). CVE-2026-102764 is not a KEV entry yet.

What defenders should do

Patch self-hosted RS (and PRA) with BT26-05-RS now. On version 24.3.1 or later, apply it from the /appliance interface, or confirm it was applied automatically if the appliance is subscribed to automatic updates. If the patch is not visible there, open a case with BeyondTrust Support referencing BT26-05. GTIG says that in past campaigns ARMORY CASTLE ran widespread, opportunistic exploitation after vulnerabilities it had first used selectively became public, and tells defenders to prepare for the same here. It frames this as possible, not confirmed; the 2024 Ivanti flaws are its comparison.
Treat any internet-reachable appliance on a vulnerable version since late August as potentially compromised until reviewed (see also the Ivanti Connect Secure zero-day).
Preserve a snapshot before changes; the actor deletes local logs and tooling.
Forward syslog and session events off the appliance. Look for forwarding gaps that start and end within one session.
Hunt for behavior, since indicators change per victim: unfamiliar admin sessions from residential or VPN addresses, unknown script files in web directories (compare the NetScaler webshells), web service accounts spawning shells, changes to Jump Item or Team permissions, and WebSocket upgrades on unexpected paths.
Restrict administrative interfaces and limit appliance outbound traffic.
If the appliance is compromised or its status is unknown, GTIG advises rebuilding it from a clean, fully patched image rather than cleaning it: customers cannot audit the host, and host-level persistence survives reboot and configuration reset. Image it first for investigators.
Rotate credentials only after the patch or rebuild, in GTIG's order: /appliance admin credentials, /login administrators, API client secrets, SAML keys and bind accounts, Vault and integrated Password Safe or PRA credentials, and integration secrets. Treat any credential typed into a support session during the window as exposed.
Review support session reports for file transfers, and the /login configuration for Jump Item roles raised to Administrator. Every endpoint touched is in scope for downstream hunting.