CVE-2026-102764, BeyondTrust Remote Support: an unauthenticated file-operation flaw exploited as a zero-day since late August by a suspected China-nexus actor that left a web shell and boot-time sudo persistence (CVSS 4.0 9.3)
BeyondTrust patches an exploited Remote Support zero-day; the actor's persistence survives reboot and reset
Defender actions
- Apply the BT26-05-RS patch to every self-hosted BeyondTrust Remote Support appliance now and confirm in the /appliance interface that it is installed (a build older than 24.3.1 must be upgraded first, which closes the hole but does not undo earlier exposure); apply it to self-hosted Privileged Remote Access appliances too, which BeyondTrust patched as a precaution.
- For every appliance that was internet-reachable on a build up to 26.2.3 at any time since late August 2026: before any change, snapshot a virtual appliance with memory and export its disk, and collect the off-box syslog, reverse-proxy or WAF and perimeter firewall logs because the actor deletes on-appliance logs; then redeploy from a clean, fully patched image every appliance whose compromise status is confirmed or unknown, and rotate the credentials it held in dependency order, including the Remote Support Vault and any credential typed into a support session.
Analysis
BeyondTrust's advisory BT26-05 of 2026-10-15 fixes CVE-2026-102764, an improper origin validation (CWE-290) in an internal messaging component of Remote Support that lets a remote attacker perform file operations on the appliance without authenticating; every version up to 26.2.3 is affected (BeyondTrust, 2026-10-15). Google's Threat Intelligence Group found in an incident response that ARMORY CASTLE, a suspected PRC-nexus espionage actor it formerly tracked as UNC5221, exploited the flaw as a zero-day in late August 2026 (GTIG, 2026-10-15); BeyondTrust dates the exploitation of one hosted instance and one self-hosted appliance to 2026-08-29 (BeyondTrust, 2026-10-15). GTIG warns that ARMORY CASTLE and others have historically exploited broadly once a flaw is public (GTIG, 2026-10-15); BeyondTrust lists government among the actor's documented targets (BeyondTrust, 2026-10-15).
After the exploit GTIG saw SAWFLY, a lightweight PHP web shell that evaluates attacker-supplied code as the appliance's unprivileged site account; the actor then made a root-owned SUID copy of the system shell, tried to dump the appliance's native secrets vault, and persisted through a boot-time script that adds a passwordless-sudo line to the sudoers template, so the escalation survives reboot and configuration reset (GTIG, 2026-10-15). It deleted appliance logs throughout, raised an account's Jump Item and Team permissions from No Access to Administrator, pulled software inventories from users' desktops through the built-in file transfer, and exposed BARECLAW, a custom SOCKS5-over-WebSocket tunneler, by editing the HAProxy configuration (GTIG, 2026-10-15).
Triage: a known administrator changing Jump Item roles or signing in from a new network under a change ticket is routine; BeyondTrust's signals are privileged sessions from residential or VPN addresses tied to no administrator or ticket (BeyondTrust, 2026-10-15).
Cited evidence
exploited this vulnerability as a zero-day, in late August 2026
CVE-2026-102764 affects all supported Remote Support versions up to 26.2.3 and allows an unauthenticated remote attacker to perform file operations on the appliance
Customers cannot audit the appliance host file system, and host-level persistence survives reboot and configuration reset.
BeyondTrust has remediated a critical vulnerability in Remote Support (RS) that could allow a remote attacker to perform file operations on an affected appliance.
As of today we are withholding the technical details of the vulnerability.
Sources3
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.