On October 15, 2026, BeyondTrust disclosed a critical zero-day vulnerability in its Remote Support product that a suspected China-linked espionage group had been quietly exploiting since late August. Tracked as CVE-2026-102764 and rated 9.3 out of 10, the flaw lets unauthenticated remote attackers upload arbitrary files to unpatched appliances. In the attacks investigators observed, that single entry point was enough to escalate to full root control and grab every credential the appliance stored or brokered. If you run a self-hosted BeyondTrust Remote Support or Privileged Remote Access appliance, you should treat patching as an emergency.
What happened: the timeline
The story broke in three stages. First came the intrusion: according to BeyondTrust, the attackers first used the flaw on August 29, 2026, against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. At that point nobody outside the attackers knew the vulnerability existed.
Then came detection. BeyondTrust says it found the intrusion on its hosted fleet on September 28, while hunting across its SaaS environment after a separate zero-day hit a different security vendor’s edge appliances. The hosted instance was contained within 27 minutes of discovery. All Remote Support and Privileged Remote Access SaaS customers had the patch applied by October 8, so cloud customers were protected before the public disclosure.
Finally came disclosure. On October 15, BeyondTrust published security advisory BT26-05, and Mandiant with the Google Threat Intelligence Group published a detailed analysis of the attacker. Google warned the same day that public disclosure would likely trigger broader exploitation attempts by this actor and others, and urged every organization with a self-hosted appliance to patch or mitigate immediately.
The vulnerability: what CVE-2026-102764 actually is
Advisory BT26-05 describes the root cause as improper origin validation in an internal messaging component. In plain terms, parts of the appliance accepted messages without checking where those messages came from. Under the right conditions, a remote attacker could abuse that gap to perform file operations on the appliance, and a successful attack ends with arbitrary file upload.
Three facts make this one especially dangerous. First, it affects every Remote Support release up to and including version 26.2.3. Second, exploitation requires no credentials and no user interaction. Third, the appliance is a trust-rich target: it stores and brokers credentials for the remote sessions it facilitates, so a compromised appliance can hand an attacker the keys to everything it touches.
BeyondTrust has deliberately withheld technical details about the flaw while self-hosted appliances are still being patched, a standard move to slow down copycat exploitation. Privileged Remote Access shares the affected code, but BeyondTrust says its internal testing found no way to exploit the vulnerability there. Out of caution, the company released the patch for PRA anyway and recommends that self-hosted PRA customers apply it immediately.
Who exploited it: meet ARMORY CASTLE
Mandiant, which investigated one of the intrusions, attributes the attacks to ARMORY CASTLE, a suspected China-nexus espionage actor it previously tracked as UNC5221. CrowdStrike tracks the same cluster of activity under the name WARP PANDA. BeyondTrust says it agrees with the attribution at moderate to high confidence.
That pairing should ring alarm bells. This is the same broader pattern seen in recent supply-chain style attacks: the product that organizations buy to reduce risk, whether a remote access appliance, an email security gateway, or a firewall, becomes the attacker’s way in. Edge appliances keep attracting this kind of attention because they sit on the network boundary with privileged access, much like the Ivanti Connect Secure zero-day that security teams scrambled to patch just days earlier. Espionage actors in particular favor these targets because the access is quiet and persistent, and state-linked operations are a recurring theme in enterprise breaches, as the FBI takedown of the Flax Typhoon hacking toolkit recently showed.
How the attack worked, step by step
Mandiant’s analysis lays out a methodical intrusion. First, the attackers gained initial access through the zero-day and uploaded files to the appliance. Then they escalated from the web service account to root-level control of the appliance host by enabling Set User ID (SUID) permissions, a classic Linux privilege escalation technique.
With root in hand, they deployed two pieces of malware: the Sawfly web shell and the Bareclaw tunneler. Then they wiped logs to evade detection and moved laterally through the victim’s network using compromised Administrator credentials, opening remote sessions on downstream systems.
The worst part is what root control bought them. Mandiant notes that it gave the attackers access to every credential the appliance stored or brokered, plus the ability to modify files that survive a reboot and a configuration reset. That combination turns a single appliance compromise into long-term, stealthy access across the environment.
Am I affected? Check your version
The guidance splits cleanly by deployment type:
- Self-hosted Remote Support at version 26.2.3 or earlier: you are vulnerable. Patch immediately, and prioritize any internet-facing appliance.
- Self-hosted Privileged Remote Access: BeyondTrust found no exploitable path, but a patch exists and the company recommends applying it as a precaution.
- BeyondTrust-hosted (SaaS) customers: the patch was applied for you on October 8. No action is needed, though reviewing for the indicators below is still wise.
For hunting signs of past compromise, Mandiant identified evidence of exploitation in the appliance’s access, syslog, messages, thin-scc, brain, and SSL log files. Those logs live on a LUKS-encrypted partition that contains the /home directory, so investigators need the right tooling and credentials to review them. Watch for web shells like Sawfly, the Bareclaw tunneler, wiped or gapped log files, and unexpected file uploads in late August or September.
What to do right now
There is no workaround listed in the advisory, so the answer is refreshingly direct:
- Patch immediately. Apply the BT26-05 update to every self-hosted Remote Support and Privileged Remote Access appliance, starting with internet-facing ones. Enable automatic updates so the next one does not require manual action.
- Hunt for compromise. Review the appliance logs for web shells, tunneled connections, and log deletions. Assume any unpatched, internet-facing appliance deserves a thorough check.
- Rotate credentials. Because a successful exploit exposed every credential the appliance stored or brokered, rotate administrative and session credentials if you suspect any exposure window.
- Restrict exposure. Keep management and appliance interfaces off the open internet wherever possible. The same advice applied after the F5 BIG-IP zero-day: if attackers cannot reach the appliance, they cannot exploit it.
- Watch for copycats. Google and Mandiant both warn that public disclosure historically brings broad, opportunistic scanning from ARMORY CASTLE and from unrelated actors. Expect internet-wide probing for unpatched appliances within days.
Frequently asked questions
Is there a patch for CVE-2026-102764?
Yes. BeyondTrust released patched builds for Remote Support and, out of caution, for Privileged Remote Access as well. SaaS customers were patched automatically on October 8. Self-hosted customers must apply the update manually unless automatic updates are enabled.
Do attackers need a login to exploit it?
No. The vulnerability requires no credentials and no user interaction. That is a major reason it scored 9.3 and why Google warned of potential widespread exploitation after disclosure.
Was BeyondTrust’s cloud service compromised?
One BeyondTrust-hosted Remote Support instance was used by the attackers in the original August intrusions. BeyondTrust says it discovered and contained that intrusion on September 28, and all SaaS instances were patched on October 8. No evidence has been published of broader customer data theft from the SaaS platform, but hosted customers should still monitor for unusual activity.
Is Privileged Remote Access affected too?
Not in any way BeyondTrust’s testing could confirm. PRA shares the affected code, so the company released a patch for it out of caution and recommends that self-hosted PRA customers install it immediately.
How do I check whether my appliance was already compromised?
Look for web shells (notably one Mandiant calls Sawfly), tunnelers (Bareclaw), unexpected file uploads, and wiped or missing log entries. The relevant logs include access, syslog, messages, thin-scc, brain, and SSL logs on the appliance’s encrypted partition. If in doubt, engage an incident response team, because the attackers are skilled at evading detection.