Attackers exploited a critical BeyondTrust Remote Support vulnerability as a zero-day, compromising both a vendor-hosted appliance and a self-hosted deployment. The flaw, CVE-2026-102764, affects all Remote Support versions up to and including 26.2.3.
BeyondTrust, Mandiant and Google Threat Intelligence Group linked the intrusions to Armory Castle, also tracked as UNC5221 and Warp Panda. They describe the actor as a China-linked, state-sponsored espionage group interested in long-term intelligence collection. That attribution is their assessment rather than a technical property of the vulnerability itself.
Exploitation was first observed on August 29 against one BeyondTrust-hosted appliance and one self-hosted appliance, according to SecurityWeek’s account of the vendor’s findings.
A message-validation failure enabled appliance file operations
CVE-2026-102764 is classified as CWE-290, Authentication Bypass by Spoofing. The NVD description says internal Remote Support components did not adequately verify where received messages originated. Under the necessary conditions, an attacker could use that weakness to perform file operations on the appliance.
SecurityWeek reported a CVSS score of 9.3, placing the vulnerability in the critical-severity range. That score expresses potential technical impact; the evidence that this flaw is being exploited comes separately from the documented intrusions.
Mandiant’s incident-response findings, as reported by SecurityWeek and The Record, show consequences extending well beyond initial appliance access. Observed activity included:
- Obtaining root-level control of the appliance host.
- Harvesting credentials, including credentials stored on the appliance.
- Giving the site service account passwordless root privileges.
- Deploying Sawfly, a lightweight PHP webshell with encrypted bidirectional command-and-control.
- Installing Bareclaw, a custom SOCKS5 proxy that supports encrypted traffic, upstream proxy chaining and authentication.
- Deleting system, web-server and application logs.
- Using compromised administrator credentials to enter the Remote Support application and expand that account’s permissions.
- Targeting internal endpoints through the compromised appliance.
- Using Remote Support’s built-in file-access and transfer functions to collect sensitive documents, including software inventories useful for network reconnaissance.
- Altering files in ways that could survive reboots and configuration resets.
Responders also reported privilege escalation and lateral movement into victim networks. These findings show that patching closes the vulnerable entry point but does not, by itself, establish that an already exposed appliance is clean.
Versions through 26.2.3 require action
BeyondTrust’s fix is distributed as the BT26-05-RS patch for Remote Support versions 24.3.1 through 26.2.3.
The required action depends on the installed release and deployment model:
| Deployment or version | Required action |
|---|---|
| Remote Support 24.3.1–26.2.3 | Apply BT26-05-RS |
| Releases older than 24.3.1 | Upgrade to a newer release, then apply the patch |
| BeyondTrust-hosted Remote Support SaaS | BeyondTrust said all customers were patched as of October 9, 2026 |
| Self-hosted Remote Support without automatic updates | Apply the fix manually |
BeyondTrust said it had produced a patch by September 30, then tested it and addressed additional exploitation paths before shipping the fix on October 8.
The reporting describes two preceding milestones: The Record says BeyondTrust was first notified on September 27, after a public attack against another vendor’s edge appliances prompted an investigation into a similar issue. SecurityWeek says the company identified the Remote Support defect on September 28.
Internet-facing appliances need compromise review
Mandiant advised organizations to treat vulnerable, internet-reachable Remote Support appliances as potentially compromised until they have been reviewed.
For defenders, the reported post-exploitation behavior provides concrete areas for investigation: unexpected administrator permission changes, passwordless root access for the site service account, altered persistent files, missing logs, unexplained use of native file-transfer functions, and evidence of Sawfly or Bareclaw. Because the actor reportedly collected stored credentials, affected organizations should also account for possible credential exposure and subsequent access beyond the appliance.
The observed deletion of multiple log types may limit appliance-local evidence. Review should therefore include relevant identity, endpoint and network telemetry rather than relying only on the Remote Support host.
Armory Castle has repeatedly targeted edge products
GTIG and Mandiant have tracked Armory Castle activity since October 2023. The group has previously been linked to exploitation of Citrix NetScaler CVE-2023-4966, Ivanti flaws CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282, and Dell RecoverPoint for Virtual Machines CVE-2026-22769.
All five are listed in CISA’s Known Exploited Vulnerabilities catalog. The Citrix and three Ivanti flaws are also recorded as used in ransomware campaigns, although that does not mean the BeyondTrust activity described here involved ransomware.
CISA added CVE-2023-4966 on October 18, 2023, with a November 8, 2023 remediation deadline; CVE-2023-46805 and CVE-2024-21887 on January 10, 2024, both due January 22, 2024; CVE-2025-0282 on January 8, 2025, due January 15, 2025; and CVE-2026-22769 on February 18, 2026, due February 21, 2026. Those deadlines apply to covered US federal agencies, not to every organization.
GTIG assessed that Armory Castle has previously used zero-days selectively before expanding exploitation after public disclosure. It said broader attempts against CVE-2026-102764 are possible—a forecast rather than evidence that such widespread activity has already occurred. Self-hosted operators should apply BT26-05-RS promptly and investigate any internet-exposed vulnerable appliance for compromise.
