--- schema: 1 kind: vulnerability title: "CVE-2026-102764, BeyondTrust Remote Support: an unauthenticated file-operation flaw exploited as a zero-day since late August by a suspected China-nexus actor that left a web shell and boot-time sudo persistence (CVSS 4.0 9.3)" headline: "BeyondTrust patches an exploited Remote Support zero-day; the actor's persistence survives reboot and reset" summary: > BeyondTrust's advisory BT26-05 of 2026-10-15 fixes CVE-2026-102764, an improper origin validation in an internal messaging component of Remote Support that lets a remote attacker perform file operations on the appliance without authenticating; all versions up to 26.2.3 are affected. Google's Threat Intelligence Group found ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221, exploiting it as a zero-day in late August 2026, leaving a web shell, a root-SUID shell and a sudoers entry that survive reboot and configuration reset, so a patched appliance that was exposed still needs a compromise check, and a rebuild where its status is confirmed or unknown. discovered_at: "2026-10-16T04:16:00Z" updated_at: null event_date: "2026-10-15" run_id: 2026-10-16T0256Z-intel priority: critical immediate_action: title: "Patch BeyondTrust Remote Support now, review every appliance exposed since late August and rebuild any with confirmed or unknown compromise status" action: > BeyondTrust and Google's Threat Intelligence Group confirm that an unauthenticated flaw in Remote Support (all versions up to 26.2.3) was exploited as a zero-day from late August 2026, GTIG attributing it to a suspected China-nexus espionage actor, and GTIG warns organizations to prepare for widespread exploitation now that the flaw is public. Apply the BT26-05-RS patch to every self-hosted appliance (builds older than 24.3.1 must be upgraded first). The actor's persistence survives reboot and configuration reset and it deletes on-appliance logs, so snapshot and collect off-box logs from any appliance that was internet-reachable on an affected build, then redeploy from a clean patched image any whose compromise status is confirmed or unknown and rotate everything it held. tags: [vulnerabilities, zero-day, actively-exploited, pre-auth, espionage, nation-state, china-nexus, patch-available] regions: [global] sectors: [public-sector, technology] entities: ["actor:verdantbamboo", "malware:sawfly", "malware:bareclaw", "product:beyondtrust-remote-support"] techniques: [T1190, T1505.003, T1548.001, T1548.003, T1555, T1685.006, T1070.004, T1572, T1090, T1098, T1078, T1219, T1005, T1037] affected_products: ["BeyondTrust Remote Support"] cves: - id: CVE-2026-102764 cvss: "9.3" epss: null type: logic-flaw vector: zero-click auth: pre-auth status: [exploited, patch-available] affected: "Remote Support, all versions up to 26.2.3 (self-hosted; SaaS tenants were patched by 2026-10-09)" fixed: "BT26-05-RS patch for versions 24.3.1 to 26.2.3; versions older than 24.3.1 must first be upgraded to a supported release" sources: - url: "https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/" publisher: "Google Threat Intelligence Group / Mandiant" date: "2026-10-15" role: primary - url: "https://www.beyondtrust.com/trust-center/security-advisories/bt26-05" publisher: "BeyondTrust (advisory BT26-05)" date: "2026-10-15" role: primary - url: "https://www.beyondtrust.com/blog/entry/bt26-05" publisher: "BeyondTrust (blog)" date: "2026-10-15" role: corroborating closed_sources: [] evidence: - quote: "exploited this vulnerability as a zero-day, in late August 2026" publisher: "Google Threat Intelligence Group / Mandiant" source_url: "https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/" - quote: "CVE-2026-102764 affects all supported Remote Support versions up to 26.2.3 and allows an unauthenticated remote attacker to perform file operations on the appliance" publisher: "Google Threat Intelligence Group / Mandiant" source_url: "https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/" - quote: "Customers cannot audit the appliance host file system, and host-level persistence survives reboot and configuration reset." publisher: "Google Threat Intelligence Group / Mandiant" source_url: "https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/" - quote: "BeyondTrust has remediated a critical vulnerability in Remote Support (RS) that could allow a remote attacker to perform file operations on an affected appliance." publisher: "BeyondTrust" source_url: "https://www.beyondtrust.com/trust-center/security-advisories/bt26-05" - quote: "As of today we are withholding the technical details of the vulnerability." publisher: "BeyondTrust" source_url: "https://www.beyondtrust.com/blog/entry/bt26-05" verification: multi-source sourcing_note: > Google's Threat Intelligence Group observed the exploitation of a self-hosted appliance during an incident response and BeyondTrust's own hunt found it on a hosted instance, so the exploitation has two first-hand observers; the advisory is the source for the affected and fixed versions. BeyondTrust attributes the activity to the same cluster with moderate to high confidence, and CrowdStrike tracks it as WARP PANDA per BeyondTrust. confidence: high references: - 2026-07-08/beyondtrust-rs-pra-preauth-bypass-cve-2026-40138-cluster - 2026-06-05/verdantbamboo-unc5221-warp-panda-an-18-month-china-nexus-int deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 1 watchlist_hit: false actions: - "Apply the BT26-05-RS patch to every self-hosted BeyondTrust Remote Support appliance now and confirm in the /appliance interface that it is installed (a build older than 24.3.1 must be upgraded first, which closes the hole but does not undo earlier exposure); apply it to self-hosted Privileged Remote Access appliances too, which BeyondTrust patched as a precaution." - "For every appliance that was internet-reachable on a build up to 26.2.3 at any time since late August 2026: before any change, snapshot a virtual appliance with memory and export its disk, and collect the off-box syslog, reverse-proxy or WAF and perimeter firewall logs because the actor deletes on-appliance logs; then redeploy from a clean, fully patched image every appliance whose compromise status is confirmed or unknown, and rotate the credentials it held in dependency order, including the Remote Support Vault and any credential typed into a support session." updates: [] migrated_from: null --- BeyondTrust's advisory BT26-05 of 2026-10-15 fixes CVE-2026-102764, an improper origin validation (CWE-290) in an internal messaging component of Remote Support that lets a remote attacker perform file operations on the appliance without authenticating; every version up to 26.2.3 is affected ([BeyondTrust, 2026-10-15](https://www.beyondtrust.com/trust-center/security-advisories/bt26-05)). Google's Threat Intelligence Group found in an incident response that ARMORY CASTLE, a suspected PRC-nexus espionage actor it formerly tracked as UNC5221, exploited the flaw as a zero-day in late August 2026 ([GTIG, 2026-10-15](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/)); BeyondTrust dates the exploitation of one hosted instance and one self-hosted appliance to 2026-08-29 ([BeyondTrust, 2026-10-15](https://www.beyondtrust.com/blog/entry/bt26-05)). GTIG warns that ARMORY CASTLE and others have historically exploited broadly once a flaw is public ([GTIG, 2026-10-15](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/)); BeyondTrust lists government among the actor's documented targets ([BeyondTrust, 2026-10-15](https://www.beyondtrust.com/blog/entry/bt26-05)). After the exploit GTIG saw SAWFLY, a lightweight PHP web shell that evaluates attacker-supplied code as the appliance's unprivileged site account; the actor then made a root-owned SUID copy of the system shell, tried to dump the appliance's native secrets vault, and persisted through a boot-time script that adds a passwordless-sudo line to the sudoers template, so the escalation survives reboot and configuration reset ([GTIG, 2026-10-15](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/)). It deleted appliance logs throughout, raised an account's Jump Item and Team permissions from No Access to Administrator, pulled software inventories from users' desktops through the built-in file transfer, and exposed BARECLAW, a custom SOCKS5-over-WebSocket tunneler, by editing the HAProxy configuration ([GTIG, 2026-10-15](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/)). **Exposure:** self-hosted Remote Support appliances on any version up to 26.2.3 without the BT26-05-RS patch; the advisory says to apply the patch manually unless the instance is subscribed to automatic updates in its /appliance interface, and a build older than 24.3.1 must be upgraded first ([BeyondTrust, 2026-10-15](https://www.beyondtrust.com/trust-center/security-advisories/bt26-05)), which closes the hole but does not undo earlier exposure ([GTIG, 2026-10-15](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/)). SaaS tenants were patched by 2026-10-09 ([BeyondTrust, 2026-10-15](https://www.beyondtrust.com/trust-center/security-advisories/bt26-05)); BeyondTrust patched Privileged Remote Access too, which shares the code, though it found no way to exploit it ([BeyondTrust, 2026-10-15](https://www.beyondtrust.com/blog/entry/bt26-05)). **Detection:** the actor deletes on-appliance logs, so use other copies: forwarded syslog for user changes that raise a Jump Item or Team role to Administrator and for account or API-account changes without a change ticket; authentication logs for administrative /login success from residential-broadband or commercial-VPN address space; reverse-proxy or WAF logs for unknown .php paths and WebSocket upgrades from non-support addresses; file transfers by accounts whose roles changed ([GTIG, 2026-10-15](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/)). Patching does not evict the actor, so GTIG advises redeploying any appliance of confirmed or unknown status from a clean, fully patched image and then rotating credentials in dependency order, from the appliance administrators to anything typed into a support session ([GTIG, 2026-10-15](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/)). **Triage:** a known administrator changing Jump Item roles or signing in from a new network under a change ticket is routine; BeyondTrust's signals are privileged sessions from residential or VPN addresses tied to no administrator or ticket ([BeyondTrust, 2026-10-15](https://www.beyondtrust.com/blog/entry/bt26-05)). **Defender takeaway:** patch every self-hosted appliance now, then treat each one that was internet-reachable on an affected build since late August as potentially compromised until reviewed, and redeploy from a clean image any whose status is confirmed or unknown ([GTIG, 2026-10-15](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/)); BeyondTrust adds that the built-in triage tool of its third-party detection platform closed the sensors' privilege-escalation alerts as false positives, and that it is working with the vendor so that automated triage cannot close high-severity signals on its own ([BeyondTrust, 2026-10-15](https://www.beyondtrust.com/blog/entry/bt26-05)).