Full Report
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]
Analysis Summary
# Vulnerability: BeyondTrust Remote Support Authentication Bypass (CVE-2026-102764) Exploited as a Zero-Day
## CVE Details
- CVE ID: CVE-2026-102764
- CVSS Score: Not provided in the article. Check the vendor advisory (BT26-05).
- CWE: CWE-290 (Authentication Bypass by Spoofing), per the article's link to the CWE definition. The article describes it generically as an authentication bypass.
## Affected Systems
- Products: BeyondTrust Remote Support (RS). Privileged Remote Access SaaS customers were patched by the vendor.
- Versions: RS 26.2.3 and earlier. The article does not name the first fixed version, so confirm it in advisory BT26-05.
- Configurations: Self-hosted (on-premises) appliances are affected. Patches must be applied manually unless automatic updates are enabled. Internet-reachable instances on vulnerable versions are the highest priority. Shadowserver tracks over 1,400 exposed BeyondTrust remote support instances.
## Vulnerability Description
An authentication bypass lets an unprivileged remote attacker perform file operations on an unpatched appliance without valid credentials. The vendor shared limited technical details. In observed intrusions, the attacker used the flaw to gain a foothold, then deployed a web shell, and escalated from the web service account to root. Mandiant reports that the attacker enabled SUID permissions to achieve root. Root access exposed every credential the appliance stored or brokered and allowed changes to files that persist across reboots and configuration resets.
## Exploitation
- Status: Exploited in the wild. Zero-day exploitation has been observed since late August 2026. No public PoC is mentioned in the article.
- Complexity: Not stated. Because the attacker is unauthenticated and remote, complexity appears to be Low, but this is inferred.
- Attack Vector: Network
**Threat actor:** Tracked by Mandiant/GTIG as "Armory Castle" (formerly UNC5221) and by CrowdStrike as "Warp Panda." Both are assessed as a suspected China-nexus espionage group. Mandiant warns of possible broader exploitation attempts as details spread, based on the group's past behavior.
## Impact
- Confidentiality: High (inferred). Attackers gained access to stored and brokered credentials and used administrator credentials for lateral movement.
- Integrity: High (inferred). Attackers modified system files and wiped logs.
- Availability: Not stated in the article. Impact is not indicated.
## Remediation
### Patches
- Self-hosted RS: Upgrade to the fixed version listed in BeyondTrust advisory BT26-05. The article does not specify the version number.
- RS and PRA SaaS: Already patched by BeyondTrust on October 8, 2026. No customer action is needed.
### Workarounds
- The article does not describe vendor-provided workarounds. Restrict network access to RS appliances, especially from the internet, until patched.
- Confirm that automatic updates are enabled, or apply patches manually.
## Detection
Mandiant advises that any appliance reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until reviewed.
**Indicators of compromise and review items:**
- Malware: Sawfly web shell and Bareclaw tunneler.
- Unexpected SUID permission changes on appliance binaries or files.
- Web service account activity that spawns root-level actions or shells.
- Gaps or wiping in system and audit logs.
- New or unexpected file modifications, including files that persist across reboots.
- Administrator logins or remote sessions opened on downstream systems that do not match known activity.
- Use of administrator credentials stored on the appliance from unexpected sources.
**Detection methods:**
- Review appliance file systems, logs, and running processes for the indicators above.
- Rotate all credentials stored or brokered by affected appliances.
- Audit downstream systems for remote sessions initiated from RS appliances.
- Check the BeyondTrust and Mandiant guidance for additional technical IOCs. The article does not list file hashes or network indicators.
## References
- BeyondTrust advisory BT26-05: hxxps://www[.]beyondtrust[.]com/trust-center/security-advisories/bt26-05
- Mandiant/GTIG analysis of Armory Castle: hxxps://cloud[.]google[.]com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
- CWE-290 definition: hxxps://cwe[.]mitre[.]org/data/definitions/290[.]html
- Shadowserver exposure dashboard: hxxps://dashboard[.]shadowserver[.]org/statistics/iot-devices/time-series/ (filtered for BeyondTrust Remote Support)
- Related BeyondTrust incident, CVE-2026-1731 (exploited for ransomware): hxxps://www[.]bleepingcomputer[.]com/news/security/cisa-beyondtrust-rce-flaw-now-exploited-in-ransomware-attacks/