BeyondTrust Remote Support pre-auth file flaw exploited as zero-day by China-nexus actor

CVE-2026-102764 is a critical flaw in BeyondTrust Remote Support in which internal components do not check where incoming messages originate, which can let an attacker perform file operations on the appliance ⁵. It carries CVSS 9.8 under v3.1 and 9.3 under v4.0 ⁵. Mandiant says an unauthenticated remote attacker can use it to upload files and reach host-level control ². All supported self-hosted versions up to and including 26.2.3 are affected ^2,3.

BeyondTrust states that a suspected China-nexus espionage actor used the bug as a zero-day against one BeyondTrust-hosted and one self-hosted instance on 2026-08-29 ¹. Google Threat Intelligence Group and Mandiant attribute the activity to ARMORY CASTLE, previously tracked as UNC5221, and BeyondTrust notes CrowdStrike tracks the same actor as WARP PANDA ^1,2. The fix shipped on 2026-10-08 and disclosure followed on 2026-10-15 ^1,8. Rapid7 reports CISA added the CVE to KEV on 2026-10-16 with a 2026-10-19 due date ³.

Google says only a small number of affected organizations are known so far, and BeyondTrust has not given a count ⁹. GTIG considers wider opportunistic exploitation after disclosure possible, noting that ARMORY CASTLE and others exploited CVE-2023-46805 and CVE-2024-21887 broadly after their disclosure ². Shadowserver tracks more than 1,400 internet-exposed Remote Support instances, per BleepingComputer, without a breakdown of patch state ⁶.

The CVE record describes a failure to validate the origin of messages received by internal Remote Support components ⁵. Rapid7 classifies it as authentication bypass by spoofing (CWE-290), while GTIG and watchTowr describe the practical outcome as arbitrary file upload ^3,2,4. BeyondTrust is withholding further technical detail until self-hosted appliances are patched ¹. Privileged Remote Access shares the affected code, but BeyondTrust's testing found no exploitation path there ¹.

In the case Mandiant investigated, the attacker sent POST requests to a non-standard .php path, and the SAWFLY PHP webshell appeared in the web root about 11 minutes later ². Running as the site service account, the actor created a root-owned SUID shell copy, tried several bt-secrets command variants to dump the site vault and then the global password safe, and added passwordless sudo that a boot script re-applies after reboots and configuration resets ². The actor then deleted host, web and application logs ².

With a compromised Administrator account, the actor raised Jump Item and Team permissions to Administrator, opened support sessions to internal endpoints, and pulled documents such as software inventories through the file-transfer feature ². They also deployed BARECLAW, a SOCKS5-over-WebSocket tunneler, and edited the appliance HAProxy configuration to expose it on a custom URI ². GTIG says exploitation can give access to every credential the appliance stores or brokers, and The Record reports the attackers obtained them ^2,7.

1. 1

   Before changing anything on a possibly exposed appliance, preserve evidence: snapshot virtual appliances with memory and collect perimeter, reverse-proxy and syslog logs ².

2. 2

   On self-hosted Remote Support 24.3.1 or later, apply BT26-05-RS from /appliance or confirm automatic updates installed it; on older releases, upgrade to a supported version and then patch ². Open a BeyondTrust support case citing BT26-05 if the patch does not appear ².

3. 3

   Apply the precautionary patch to self-hosted Privileged Remote Access; SaaS Remote Support and PRA tenants were patched by the vendor ¹.

4. 4

   Reduce exposure: restrict the admin interface to trusted networks and allow outbound traffic from the appliance only to destinations it needs ^1,2.

5. 5

   Treat any internet-reachable appliance that ran a vulnerable version during the exploitation window as potentially compromised, and rebuild confirmed-compromised appliances from a clean, patched image rather than cleaning them ².

6. 6

   After patching or rebuilding, rotate every credential the appliance stored or injected, in dependency order, and review new MFA registrations on privileged accounts ^2,1.

7. 7

   Enforce SAML SSO with phishing-resistant MFA and set the default Jump Item role to No Access ².

• Review web access logs for POST requests to unknown .php paths and for WebSocket upgrades from outside support staff or endpoint ranges ².
• Scan the appliance web root (under ingredi/app/laravel/public/) for unrecognized script files and look for web service accounts spawning shells ^1,2. Run the GTIG YARA rules G_Hunting_Webshell_SAWFLY_1 and G_Hunting_Backdoor_BARECLAW_1 over collected files ².
• Check for /usr/bin/dbus-authd, a zz-root-persist script in /home/bomgar/sbin/post_boot.d, unexpected entries in /ns/config/sudoers.template, and a /uidchanarge route in /ns/config/haproxy.conf ².
• Alert on user_changed events that raise Jump Item or Team roles to Administrator, and on user_added, api_account or security_provider events with no change ticket ².
• Flag /login admin successes from residential broadband or commercial VPN ranges and logins outside business hours ^1,2.
• Look for syslog forwarding gaps that start and end within one session, and forward appliance logs to a SIEM in near real time because the actor deletes local logs ¹.
• Appliance logs sit on an encrypted partition that may need vendor help to read; BeyondTrust offers a threat hunting package and asks for a Sev 1 case citing BT26-05 if compromise is suspected ^4,1.

1. Aug 29, 2026

   Zero-day exploitation of one BeyondTrust-hosted and one self-hosted Remote Support instance ¹

2. Sep 27, 2026

   Mandiant sends BeyondTrust a non-specific alert; an unrelated campaign against another vendor goes public the same day and BeyondTrust starts hunting ¹

3. Sep 28, 2026

   BeyondTrust detects and contains the activity and reproduces the entry vector ¹

4. Sep 30, 2026

   Mandiant shares findings from the self-hosted victim; fix validated on a test build ¹

5. Oct 8, 2026

   Patch released to SaaS and self-hosted customers ¹

6. Oct 9, 2026

   All Remote Support SaaS tenants reported patched ²

7. Oct 15, 2026

   Coordinated disclosure: CVE, advisory BT26-05 and GTIG/Mandiant analysis ¹

8. Oct 16, 2026

   CISA adds CVE-2026-102764 to the KEV catalog ³

9. Oct 19, 2026

   KEV remediation due date for US federal agencies ³

1. 1
   ARMORY CASTLE and BT26-05: What Security Teams Need to Know

   BeyondTrust · Vendor · Oct 15, 2026
2. 2
   ARMORY CASTLE Exploits BeyondTrust

   Google Threat Intelligence Group / Mandiant · Research · Oct 15, 2026
3. 3
   CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

   Rapid7 · Research · Oct 19, 2026
4. 4
   CVE-2026-102764: BeyondTrust Remote Support Arbitrary File Upload

   watchTowr · Research · Oct 16, 2026
5. 5
   CVE-2026-102764

   Tenable · Database · Oct 17, 2026
6. 6
   BeyondTrust patches zero-day exploited in attacks since August

   BleepingComputer · News · Oct 16, 2026
7. 7
   Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day

   The Record · News · Oct 16, 2026
8. 8
   Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

   SecurityWeek · News · Oct 16, 2026
9. 9
   Prolific Chinese espionage group exploits BeyondTrust zero-day

   CyberScoop · News · Oct 16, 2026