BeyondTrust Zero-Day CVE-2026-102764: Patch Now

BeyondTrust zero-day CVE-2026-102764 was secretly exploited by hackers since August 2026. Here is what happened, who is affected, and how to patch it now.

What Happened: A Zero-Day Hiding Since August

On October 15, 2026, BeyondTrust disclosed a critical vulnerability in its Remote Support product that attackers had already been exploiting for weeks. The flaw is tracked as CVE-2026-102764 and carries a CVSS score of 9.3 out of 10, putting it firmly in the "Critical" range.

A zero-day is a flaw that attackers discover and use before the vendor has a fix ready. Here the gap between first exploitation and public disclosure was about seven weeks. The flaw was first exploited on August 29, 2026, against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. The company found the hosted intrusion on September 28, during proactive hunting across its cloud fleet, and contained it within 27 minutes. It shipped the fix on October 8, cloud customers were fully patched by October 9, and public disclosure followed on October 15, alongside an investigation by Google's Mandiant team.

The attacker is a suspected China-linked espionage group that Mandiant and Google Threat Intelligence Group call Armory Castle, previously tracked as UNC5221 and by CrowdStrike as Warp Panda. BeyondTrust agrees with that attribution with moderate to high confidence. This is not a ransomware crew chasing a quick payout. Armory Castle focuses on long-term intelligence gathering, quietly breaking into networks and staying there to collect information.

What Is BeyondTrust Remote Support?

If you have ever had an IT technician take control of your computer to fix a problem, you have seen a remote support tool in action. BeyondTrust Remote Support, formerly known as Bomgar, is the enterprise version of that idea. IT help desks use it to connect to employees' computers, servers, and other machines to troubleshoot problems without being in the same room.

That convenience is what makes it such a valuable target. A remote support appliance stores and brokers the passwords and keys that open other machines, and it can start sessions across the organization. If an attacker takes over the appliance, they gain the keys to much of the network behind it. BeyondTrust says more than 20,000 organizations use its products, including 75 of the Fortune 100.

How the BeyondTrust Zero-Day Attack Works

The flaw is improper origin validation in an internal messaging component. In plain English, part of the appliance accepts messages without properly checking where they came from. An attacker who can reach the appliance over the network can send a crafted message the appliance trusts, and use that trust to perform file operations on it. No login, no password, and no help from any user is required.

File operations may sound harmless, but they are the crack that opens the door. Here is how Mandiant says Armory Castle turned that opening into full control.

Step 1: Plant a Web Shell

The attackers used the flaw to upload a web shell, a small malicious program that runs on the appliance's web server and lets the attacker send it commands. Mandiant calls this web shell Sawfly. It is an obfuscated PHP backdoor, disguised as mangoapi.php, that returns a plain "not found" error when it does not recognize a request, helping it blend in with normal traffic.

Step 2: Climb to Root

With the web shell in place, the attackers escalated from the limited web service account to root, the highest level of control on the appliance, by enabling Set User ID, or SUID, permissions on a copied system file. Once they had root, they could read every credential the appliance stored or brokered.

Step 3: Dig In and Move Sideways

Next came persistence and lateral movement, the steps that turn a single break-in into a lasting foothold:

• Survived restarts with a boot script that restored access after reboot.
• Erased evidence by wiping logs.
• Opened a tunnel with a custom tool Mandiant calls Bareclaw, a durable path back in.
• Abused administrator accounts to raise Jump Item permissions, the saved shortcuts for connecting to machines, to Administrator level.
• Moved into the network via remote sessions onto downstream systems, using the appliance's own file transfer to pull out reconnaissance documents.

Are You Affected? Check Your Version

CVE-2026-102764 affects all BeyondTrust Remote Support versions up to and including 26.2.3. The fix is patch BT26-05-RS for versions 24.3.1 through 26.2.3. If you run a version older than 24.3.1, upgrade to a supported version first, then apply the patch.

Cloud customers are in better shape: BeyondTrust says the patch was applied to all Remote Support SaaS customers by October 9. Self-hosted customers must patch manually if automatic updates are not enabled, and should verify through the appliance's /appliance interface that BT26-05-RS is installed. Shadowserver tracks more than 1,400 BeyondTrust remote support instances exposed online, every one a potential target until patched.

What to Do Now: Patch and Hunt for Signs of Compromise

If your organization runs BeyondTrust Remote Support, act in this order:

• Patch now. Apply BT26-05-RS to Remote Support, and the precautionary patch to self-hosted Privileged Remote Access. Do not wait for a maintenance window if the appliance is reachable from the internet.
• Assume breach if it was exposed. Mandiant warns that any internet-reachable appliance on a vulnerable version during the exploitation window should be treated as potentially compromised until reviewed. A clean log is not proof of safety, because the attackers deleted logs.
• Hunt for the known malware. Look for the Sawfly web shell (mangoapi.php), unexpected SUID files, unfamiliar boot scripts, and the Bareclaw tunneler.
• Review Jump Items and admin accounts. Check whether any Jump Item or team permissions were raised to Administrator without a legitimate reason, and review remote sessions that originated from the appliance.
• Rotate credentials. Root access exposed every credential the appliance stored or brokered, so change the passwords, keys, and secrets that passed through a potentially compromised appliance.
• Watch for a second wave. In past campaigns, Armory Castle has followed public disclosure with widespread, opportunistic exploitation, racing to break in before patches are deployed.

Why Remote Support Tools Keep Getting Targeted

This is not the first time Armory Castle has used this playbook. Mandiant says the group has been active since at least October 2023, exploiting zero-days in network edge appliances, the devices at the boundary between a company and the internet. Past targets include Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282).

BeyondTrust has been a repeated target: attackers recently exploited another critical flaw, CVE-2026-1731, in the same products to deploy ransomware.

The lesson is the same one this blog keeps coming back to: the devices that protect your network need the same urgency as the network itself. Patch internet-facing appliances fast, keep them under close monitoring, and treat any internet-reachable device running a vulnerable version as a possible breach, not just a missed update.

For more on threats like this, see our more cybersecurity news and more technology news.

The bottom line: a critical zero-day, exploited for seven weeks by an espionage group, with a patch already available. If you run BeyondTrust Remote Support, today is the day to patch it and check for intruders.

Sources: BleepingComputer, SecurityWeek, The Hacker News