Message-origin spoofing enables file ops on BeyondTrust Remote Support
CISA: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
CVSS 4.0
9.3critical
EPSS
<1%p48
Published
()
KEV added
AI analysis
CVE-2026-102764 is a critical (CVSS 4.0 9.3) authentication-bypass-by-spoofing flaw (CWE-290) in internal components of BeyondTrust Remote Support. Those components do not adequately check the origin of messages they receive, so a remote attacker can, under the right conditions, send spoofed messages over the network with no privileges and no user interaction. Successful exploitation can allow file operations on the appliance, with high impact to confidentiality, integrity, and availability of the vulnerable system and no stated impact on other systems. The provided data identifies BeyondTrust Remote Support but does not name affected version ranges. No public proof of concept is known and the CVE is not listed in CISA KEV; a related headline refers to “ARMORY CASTLE” exploiting BeyondTrust, but that report is not confirmed by the structured advisory data.
What to do: Keep BeyondTrust Remote Support appliances off untrusted networks and allow management and support traffic only from trusted sources. Apply the vendor patch or hotfix for this issue as soon as BeyondTrust publishes it for your build, and review appliance logs for unexpected file operations or messages from untrusted origins. No fixed version is named in the provided data, so confirm the corrected release directly with BeyondTrust.
Affected
BeyondTrust Remote Support
—
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
CISA Known Exploited Vulnerability
Affected
BeyondTrust Remote Support
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and deployed the SAWFLY webshell.
BeyondTrust said China-nexus actor Armory Castle, formerly UNC5221 and also known as UTA0178, exploited critical Remote Support flaw CVE-2026-102764 as a zero-day beginning August 29, 2026. The 9.3-rated bug is in an internal messaging component that failed to validate message origins, letting attackers remotely control targeted systems. The group deployed its custom PHP webshell SAWFLY within 11 minutes. BeyondTrust says it serves more than 20,000 customers; earlier research found about 11,000 internet-exposed Remote Support instances. Ivanti, Cisco, and Palo Alto Networks also disclosed exploited edge-device flaws the same week.
Chinese espionage group Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 for root and credential-vault access.
Mandiant and Google Threat Intelligence Group say Armory Castle, a suspected China-nexus espionage actor formerly tracked as UNC5221 and by CrowdStrike as WARP PANDA, exploited BeyondTrust Remote Support zero-day CVE-2026-102764 starting Aug. 29, 2026. The unauthenticated flaw, CVSS 9.3, allows file operations, host-level control, and access to credentials the appliance stores or brokers. The actor deployed the SAWFLY PHP web shell, a SUID root backdoor, passwordless sudo persistence, and the BARECLAW SOCKS5 tunneler, then wiped logs. BeyondTrust released a patch on Oct. 8 in advisory BT26-05; self-hosted internet-exposed systems should be reviewed, while SaaS instances were patched automatically.
BeyondTrust patched CVE-2026-102764, a Remote Support authentication bypass exploited since August by China-linked Armory Castle.
BeyondTrust patched CVE-2026-102764, a critical authentication bypass in Remote Support 26.2.3 and earlier that lets unprivileged remote attackers perform file operations. Mandiant and Google Threat Intelligence Group say China-nexus Armory Castle, also UNC5221 and CrowdStrike's Warp Panda, exploited it since late August, gained root through SUID permissions, deployed the Sawfly web shell and Bareclaw tunneler, wiped logs, and moved laterally with stolen administrator credentials. SaaS customers were patched on October 8, while self-hosted systems require a manual update. Shadowserver tracks more than 1,400 exposed instances, and Mandiant warned exploitation may broaden now that the flaw is public.
Chinese espionage group Armory Castle is exploiting BeyondTrust Remote Support zero-day CVE-2026-102764.
BeyondTrust, Mandiant and Google confirmed that suspected Chinese espionage group Armory Castle, also tracked as UNC5221, exploited zero-day CVE-2026-102764 in BeyondTrust Remote Support appliances. Activity was traced to August 29, 2026, and a patch plus mitigations are available. Attackers escalated privileges, moved laterally, stole every stored credential and installed custom malware called Sawfly and Bareclaw that survives reboots and resets. Google warns the group often shifts from selective zero-day use to broad exploitation after disclosure, as it did with Ivanti flaws CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282.
CISA says attackers are exploiting critical BeyondTrust Remote Support flaw CVE-2026-102764, now on KEV.
CISA warned that CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier, is being actively exploited for initial access, persistence, privilege escalation, and lateral movement. The agency added the flaw to the Known Exploited Vulnerabilities catalog on October 16, 2026. Supported self-hosted versions 24.3.1 and later need the BT26-05-RS patch, while older versions must upgrade first; BeyondTrust-hosted SaaS deployments are already patched. CISA also urged log and memory forensics, isolation of suspected appliances, credential rotation, and review of Mandiant's ARMORY CASTLE guidance.
Google says China-linked Armory Castle exploited critical BeyondTrust flaw CVE-2026-102764 and retained root on appliances.
Google warned that Armory Castle, a suspected China state-sponsored espionage actor active since October 2023, exploited critical BeyondTrust Remote Support flaw CVE-2026-102764 in August 2026. The vulnerability has a CVSS score of 9.3; BeyondTrust disclosed it on October 15 after shipping a patch on October 8 and is withholding technical details. Post-exploitation included the Sawfly PHP web shell, a SUID root backdoor, credential harvesting with bt-secrets, Administrator Jump permissions, the Bareclaw tunneler, and log deletion. Google said the group and others may move to broad opportunistic exploitation and advised customers to patch, restrict appliance access, rotate credentials, and rebuild compromised systems.
China-nexus UNC5221 exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and wiped logs.
BeyondTrust and Mandiant say a suspected China-nexus espionage cluster exploited critical zero-day CVE-2026-102764 in BeyondTrust Remote Support on 29 August 2026, hitting one hosted instance and one self-hosted appliance, then deleted logs and tooling. BeyondTrust assesses with moderate to high confidence that the actor is UNC5221, which Mandiant calls ARMORY CASTLE and CrowdStrike tracks as WARP PANDA, previously linked to Citrix NetScaler and Ivanti Connect Secure zero-days. The intruder used a custom web shell and tunneling tool, reached full admin control within minutes, and read stored secrets. SaaS instances were patched automatically; self-hosted Remote Support and Privileged Remote Access need advisory BT26-05. Technical details are being withheld while appliances are patched.
Attackers exploited BeyondTrust Remote Support zero-day CVE-2026-102764 from August to gain full admin access.
Mandiant says suspected China-nexus espionage group ARMORY CASTLE, previously UNC5221 and also called WARP PANDA, exploited CVE-2026-102764 in BeyondTrust Remote Support starting August 29, 2026. The unauthenticated flaw, in versions through 26.2.3, allows remote file operations that can lead to full host control. Attackers installed the SAWFLY PHP web shell, escalated to root, persisted with a startup script, tunneled traffic using BARECLAW, expanded Jump Item access, collected data, and deleted logs. BeyondTrust patched on October 8, hosted tenants were updated by October 9, and a precautionary Privileged Remote Access patch was also released.
China-linked ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 for root access and persistent backdoors.
Google Threat Intelligence Group and Mandiant say China-nexus group ARMORY CASTLE, previously UNC5221, exploited BeyondTrust Remote Support zero-day CVE-2026-102764 in late August 2026, before the October 15 disclosure. The unauthenticated flaw enabled remote file operations; attackers deployed the SAWFLY PHP webshell, escalated to root with a SUID binary, read the secrets vault, and installed the BARECLAW SOCKS5 tunneler. BeyondTrust patch BT26-05 covers supported versions through 26.2.3. SaaS tenants were patched on October 9, and appliances that may have been compromised should be rebuilt rather than only rebooted.
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 to seize support appliances.
BeyondTrust said CVE-2026-102764, CVSS 9.3, is improper origin validation in Remote Support internal messaging that lets a remote attacker perform file operations. China-nexus group Armory Castle, also tracked as UNC5221 and Warp Panda, exploited it as a zero-day on August 29, 2026 against one self-hosted appliance. SaaS customers were patched by October 9; self-hosted versions 24.3.1 through 26.2.3 need patch BT26-05-RS. Mandiant reported follow-on use of the SAWFLY PHP web shell, SUID privilege escalation, secret harvesting, Jump remote sessions, the BARECLAW SOCKS5 tunneler, and log deletion.
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 starting in late August.
Mandiant and Google Threat Intelligence Group say China-nexus espionage group Armory Castle, previously tracked as UNC5221, exploited critical CVE-2026-102764 in BeyondTrust Remote Support. The first known attack was on August 29; the actor then escalated privileges, moved across networks, and tried to evade detection. Only a small number of victims are confirmed, but researchers warned that stealthy pre-disclosure compromises may be broader. BeyondTrust patched self-hosted customers on October 8 and automatically updated cloud versions the same day. The group previously exploited Ivanti flaws, CitrixBleed, and last year’s Brickstorm campaign.
BeyondTrust Remote Support CVE-2026-102764 is being exploited for unauthenticated file upload and full appliance compromise.
Canada's Cyber Centre alert AL26-025 warns of CVE-2026-102764, a critical authentication-bypass-by-spoofing flaw (CWE-290) in all versions of BeyondTrust Remote Support. A remote unauthenticated attacker can abuse weak origin checks in internal messaging to upload arbitrary files and fully compromise an appliance, with no credentials or user interaction. Open-source reporting indicates exploitation in the wild. SaaS Remote Support and Privileged Remote Access were patched on 9 October 2026; self-hosted versions 24.3.1 through 26.2.3 need the BT26-05-RS patch, and older installs must upgrade first.
China-linked Armory Castle exploited BeyondTrust Remote Support CVE-2026-102764 as a zero-day since August.
Mandiant and Google’s threat intelligence group say China-linked Armory Castle, also tracked as UNC5221 and Warp Panda, exploited BeyondTrust Remote Support flaw CVE-2026-102764 as a zero-day starting August 29, 2026. The CVSS 9.3 bug allows file operations through improper validation of message origins and affects all Remote Support versions through 26.2.3; patch BT26-05-RS covers 24.3.1 through 26.2.3, and BeyondTrust says SaaS customers were patched by October 9. Attackers deployed the Sawfly PHP webshell and Bareclaw SOCKS5 tunneler, obtained root, harvested credentials, deleted logs, and exfiltrated internal documents via the product’s file-transfer feature. The group has previously exploited zero-days in Citrix NetScaler, Ivanti Connect Secure, and Dell RecoverPoint.
China-linked ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 for root access before disclosure.
Mandiant says suspected China-linked espionage group ARMORY CASTLE, previously UNC5221, exploited BeyondTrust Remote Support zero-day CVE-2026-102764 in late August 2026, weeks before the October 15 disclosure. Attackers uploaded a file, deployed the SAWFLY PHP webshell, and copied a shell with the SUID bit to gain root from an unprivileged service account. They queried the bt-secrets credential utility, planted sudoers persistence, deleted logs, and expanded portal permissions to reach internal systems. A custom tunneler, BARECLAW, relayed TCP over a SOCKS5 WebSocket proxy exposed through HAProxy. BeyondTrust has issued patches; prior root-level compromise may persist after patching.
Suspected China-nexus group ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 to steal appliance credentials.
Mandiant says ARMORY CASTLE, a suspected China-nexus espionage actor formerly tracked as UNC5221, exploited BeyondTrust Remote Support CVE-2026-102764 as a zero-day in late August 2026. The vulnerability allows arbitrary file upload. After entry, the actor used the SAWFLY PHP webshell and BARECLAW tunneler, created a root SUID shell, extracted credentials with the appliance's bt-secrets utility, and removed logs. BeyondTrust has issued patches, and Mandiant expects other actors may exploit the bug widely.
CISA added actively exploited Fortinet and BeyondTrust flaws to the Known Exploited Vulnerabilities catalog.
CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. CVE-2025-61624 is a path-traversal flaw in multiple Fortinet products, and CVE-2026-102764 is an authentication-bypass-by-spoofing flaw in BeyondTrust Remote Support. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of KEV entries that can give total control of exposed assets. CISA encourages all organizations to patch these vulnerabilities first.
Canada's Cyber Centre warns BeyondTrust Remote Support CVE-2026-102764 is being exploited in the wild.
The Canadian Centre for Cyber Security issued advisory AV26-1054 on October 16, 2026, covering BeyondTrust Remote Support versions up to and including 26.2.3. Open-source reporting indicates CVE-2026-102764 is being exploited in the wild. The centre urges users and administrators to review BeyondTrust's links and apply updates as they become available.
SOCRadar reports BeyondTrust zero-day CVE-2026-102764 is being exploited, but the page lacks technical detail.
SOCRadar’s headline reports that BeyondTrust zero-day CVE-2026-102764 is being exploited. The retrieved page is dominated by site navigation and does not include affected versions, CVSS, attacker details, or remediation steps. Treat the exploitation claim as reported but technically unverified from this text.