SOCRadar reports BeyondTrust zero-day CVE-2026-102764 is being exploited, but the page lacks technical detail.
SOCRadar’s headline reports that BeyondTrust zero-day CVE-2026-102764 is being exploited. The retrieved page is dominated by site navigation and does not include affected versions, CVSS, attacker details, or remediation steps. Treat the exploitation claim as reported but technically unverified from this text.
Headline says BeyondTrust zero-day CVE-2026-102764 is exploited.
Retrieved page is mostly site navigation, with no patch or impact details.
Message-origin spoofing enables file ops on BeyondTrust Remote Support
CVE-2026-102764 is a critical (CVSS 4.0 9.3) authentication-bypass-by-spoofing flaw (CWE-290) in internal components of BeyondTrust Remote Support. Those components do not adequately check the origin of messages they receive, so a remote attacker can, under the right conditions, send spoofed messages over the network with no privileges and no user interaction. Successful exploitation can allow file operations on the appliance, with high impact to confidentiality, integrity, and availability of the vulnerable system and no stated impact on other systems. The provided data identifies BeyondTrust Remote Support but does not name affected version ranges. No public proof of concept is known and the CVE is not listed in CISA KEV; a related headline refers to “ARMORY CASTLE” exploiting BeyondTrust, but that report is not confirmed by the structured advisory data.
Do: Keep BeyondTrust Remote Support appliances off untrusted networks and allow management and support traffic only from trusted sources. Apply the vendor patch or hotfix for this issue as soon as BeyondTrust publishes it for your build, and review appliance logs for unexpected file operations or messages from untrusted origins. No fixed version is named in the provided data, so confirm the corrected release directly with BeyondTrust.
BeyondTrust has disclosed CVE-2026-102764, a critical Remote Support vulnerability exploited as a zero-day weeks before customers received a patch.
The attack began on August 29, 2026, when one BeyondTrust-hosted Remote Support instance and one self-hosted appliance were compromised. BeyondTrust detected the hosted incident during proactive hunting on September 28, reproduced the entry vector that day, released patches on October 8, and publicly disclosed the CVE on October 15.
Researchers attribute the activity to ARMORY CASTLE, formerly tracked as UNC5221, a suspected PRC-nexus espionage actor known for targeting edge appliances.
What Is CVE-2026-102764?
CVE-2026-102764 is an improper origin validation vulnerability (CWE-290) in an internal Remote Support messaging component.
According to BeyondTrust, the component did not adequately validate where received messages originated. Under the right conditions, this allows remote attackers to trigger file operations without authentication or user interaction. BeyondTrust rates the flaw Critical with a CVSS v4.0 score of 9.3.
SOCRadar Vulnerability Intelligence card for CVE-2026-102764
The vulnerability itself provides the file operation capability. Root access is a subsequent exploitation outcome: observed attackers upload a webshell and later elevate privileges to gain full control of the appliance.
Which BeyondTrust Versions Are Affected?
Product****Status
Remote Support 26.2.3 and earlier Affected
Versions 24.3.1–26.2.3 Apply BT26-05-RS
Versions older than 24.3.1 Upgrade first, then apply patch
Remote Support SaaS Patched by October 9
BeyondTrust released the patch on October 8, before coordinated public disclosure on October 15. SaaS instances were automatically remediated, while self-hosted customers must verify that BT26-05-RS was applied through the /appliance interface or automatic updates.
Privileged Remote Access shares affected code, but BeyondTrust says it has not identified an exploitation path for PRA. The company nevertheless released a precautionary patch and recommends that self-hosted PRA customers apply it.
How Did ARMORY CASTLE Exploit BeyondTrust?
BeyondTrust’s incident advisory says CVE-2026-102764 was exploited as a zero-day on August 29, 2026, against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. BeyondTrust detected the hosted activity during proactive hunting on September 28, reproduced the entry vector that day, and released the BT26-05 patch on October 8 ahead of coordinated disclosure on October 15.
In their detailed investigation, Google Threat Intelligence Group (GTIG) and Mandiant attributed the zero-day exploitation and subsequent malware deployment to ARMORY CASTLE, formerly tracked as UNC5221. GTIG describes the group as a suspected PRC-nexus espionage actor with a history of targeting edge appliances.
After exploiting CVE-2026-102764, the actor moved through several stages to turn the initial file upload capability into persistent access and internal network reach.
ARMORY CASTLE’s exploitation of CVE-2026-102764
1. Establishing a Webshell Foothold
Following the initial exploit, suspicious POST requests were observed. About 11 minutes later, the appliance recorded creation of SAWFLY (mangoapi.php), a lightweight PHP webshell placed in the web root. ARMORY CASTLE then used SAWFLY as a primary interactive foothold.
2. Escalating to Root and Establishing Persistence
SAWFLY initially ran under an unprivileged service account. The actor abused SUID permissions to obtain root-level execution, then modified startup configuration so the service account retained passwordless administrative privileges after reboots or configuration resets.
3. Targeting Stored Credentials
With root access, ARMORY CASTLE attempted to use BeyondTrust’s native bt-secrets utility to retrieve credentials from the appliance’s secrets store, including passwords, API keys, and endpoint credentials.
The actor also deleted related logs and other appliance records, reinforcing BeyondTrust’s recommendation that defenders preserve telemetry off the appliance rather than relying only on local evidence.
4. Moving Into the Internal Network
The attacker later used compromised administrator credentials to access the Remote Support portal and changed Jump Item and Team permissions from No Access to Administrator.
That access allowed the actor to initiate Remote Support sessions to internal endpoints and use the platform’s built-in file transfer capabilities to obtain sensitive documents useful for internal reconnaissance.
5. Deploying BARECLAW
ARMORY CASTLE also deployed BARECLAW (ingredi_ws), a custom SOCKS5-over-WebSocket tunneler, and modified HAProxy configuration to route a specially configured web path to the locally running tunnel.
This provided another channel through the compromised Remote Support appliance for reaching downstream systems while making the local listener harder to identify through ordinary external scanning.
GTIG warns that ARMORY CASTLE has previously moved from selective zero-day exploitation to broader, opportunistic attacks after vulnerabilities become public. As of the October 15 analysis, however, widespread exploitation of CVE-2026-102764 had not been confirmed.
Track Emerging Zero-Day Threats with SOCRadar
SOCRadar’s Cyber Threat Intelligence module, powering Vulnerability Intelligence, can help teams monitor CVE-2026-102764 for exploitation developments, threat actor activity, indicators, and remediation changes.
Vulnerability Intelligence provides additional technical and risk context, while Attack Surface Management can help identify internet-facing BeyondTrust Remote Support appliances that require immediate patch validation and compromise assessment.
SOCRadar Vulnerability Intelligence
What Should Defenders Do?
Treat any vulnerable Remote Support appliance that was internet-accessible during the exploitation window as potentially compromised until reviewed, rather than assuming that installing the patch resolves prior compromise.
Defenders should:
Patch immediately: Apply BT26-05-RS. Systems older than 24.3.1 must first move to a supported release.
Preserve evidence: Snapshot virtual appliances and retain external syslog, WAF, reverse-proxy, firewall, and authentication telemetry before rebuilding.
Rebuild suspected systems: It is recommended to redeploy confirmed or potentially compromised appliances from a clean, patched image rather than relying on cleanup.
Rotate credentials after remediation: Include appliance administrators, API secrets, SAML material, vault credentials, integrations, and credentials used during support sessions.
Reduce exposure: Restrict /login and /appliance administration to trusted networks, limit outbound connectivity, and forward logs off the appliance.
For hunting, prioritize unexpected privileged sessions from residential or VPN networks, unknown PHP files in web directories, web-service accounts spawning shells, user_changed events that elevate Jump Item or Team permissions, unusual WebSocket traffic, HAProxy changes, and unexplained gaps in forwarded logs. BeyondTrust specifically stresses off-appliance logging because the observed actor deleted local evidence.
Indicators of Compromise (IOCs)
Mandiant also published file indicators and YARA rules for SAWFLY and BARECLAW in its technical analysis, which defenders can incorporate into investigations alongside behavioral hunting.
Extended threat intelligence platform. Outside-in visibility across the surface, deep, and dark web, for defenders who need to act before threats land.
Get the SOCRadar brief every Thursday.
New threat research, vulnerability alerts, and dark web trends, read by 30,000+ security professionals.
Cyber Threat Intelligence Threat hunting and threat actor tracking with behavioral analytics.
Advanced Dark Web Monitoring Detect credentials and sensitive data leaked on dark web markets, forums & Telegram. Attack Surface Management Discover your assets with a hacker mindset. Continuously map and monitor exposure.
Brand Protection Actionable alerts against phishing, impersonation and brand abuse.
Supply Chain Intelligence Detect compromised vendors and evaluate your entire supply network's posture.
Latest Report April 2026 · 42 pages 2026 EMEA Threat Landscape Report Read the Report
Cisco Secure Email & PAN-OS Zero-Days Exploited Oct 15, 2026
SOCRadar Splunk Integration: New MSSP and Vulnerability Apps Oct 15, 2026
CVE-2026-105445: Docker Hub PAT Reassignment Flaw Oct 14, 2026
CVE-2026-89111: Critical SAP Cloud SDK SSRF Oct 14, 2026
Top RCE Vulnerabilities Oct 14, 2026
SOCRadar Oct 15, 2026 ### Cisco Secure Email & PAN-OS Zero-Days Exploited
SOCRadar Oct 15, 2026 ### SOCRadar Splunk Integration: New MSSP and Vulnerability Apps
SOCRadar Oct 14, 2026 ### CVE-2026-105445: Docker Hub PAT Reassignment Flaw
SOCRadar Oct 14, 2026 ### CVE-2026-89111: Critical SAP Cloud SDK SSRF
4.7/5★★★★★★★★★★
