CVE-2026-102764 — an authentication bypass in BeyondTrust Remote Support — has been exploited in the wild since late August, allowing unprivileged remote attackers to perform file operations on vulnerable appliances and, in some intrusions, to escalate to full root control.
CVE-2026-102764 and the affected Remote Support builds
BeyondTrust warned customers that the flaw, tracked as CVE-2026-102764, affects Remote Support (RS) 26.2.3 or earlier. The vendor patched the security issue for all Remote Support and Privileged Remote Access SaaS customers on October 8, but self-hosted installations must be patched manually if automatic updates are not enabled. BeyondTrust described Remote Support as an "enterprise-grade support solution" used by IT service desks, help desks, and customer support teams to troubleshoot issues remotely.
How Armory Castle (UNC5221 / Warp Panda) used the zero-day
Security researchers at Mandiant and Google Threat Intelligence Group (GTIG) have linked the zero-day activity to a suspected China-nexus espionage actor tracked by both firms as Armory Castle (Mandiant and GTIG) and by CrowdStrike as Warp Panda. According to Mandiant, the actor exploited the vulnerability to gain initial access, then escalated to root privileges by enabling Set User ID (SUID) permissions.
Mandiant said the intruders deployed a new Sawfly web shell and a Bareclaw tunneler, wiped logs to evade detection, and used compromised Administrator credentials to move laterally by opening remote sessions on downstream systems. "After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host. This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset," Mandiant wrote.
Mandiant further warned: "Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed." The company added that Armory Castle has a history of targeting zero-day vulnerabilities in network edge appliances and cautioned that "it is possible that we will observe similar widespread exploitation attempts associated with CVE-2026-102764."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildPatch status, internet exposure, and mitigation scope
BeyondTrust's October 8 SaaS patch closed the vulnerability for hosted customers, but the vendor's advisory makes clear that self-hosted appliances without automatic updates remain at risk until manually updated. Internet threat watchdog Shadowserver reports it is tracking over 1,400 BeyondTrust Remote Support instances exposed online, though Shadowserver's tally does not indicate how many of those instances have already been secured or are honeypots.
The technical details Mandiant provides underscore the operational danger: once an appliance is controlled at root, attackers can harvest stored or brokered credentials and leave persistent modifications that survive reboot and configuration reset. The Blue Report 2026, cited in the advisory material, captures the operational reality succinctly: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply."
Earlier compromises of BeyondTrust and the larger pattern
CVE-2026-102764 is the latest in a series of BeyondTrust vulnerabilities that have been exploited in the wild. Threat actors previously used another critical Remote Support and Privileged Remote Access remote code execution flaw, CVE-2026-1731, to establish WebSocket channels and deploy ransomware. Separately, a group tracked as Silk Typhoon is believed to have exploited two zero-days (CVE-2024-12356 and CVE-2024-12686) to breach BeyondTrust's systems and to use a stolen API key to compromise 17 Remote Support SaaS instances — including the U.S. Treasury Department's instance. Silk Typhoon has also targeted the Office of Foreign Assets Control (OFAC) and the Committee on Foreign Investment in the United States (CFIUS) in the same campaign.
Armory Castle's operational profile includes opportunistic, rapid exploitation of disclosed vulnerabilities across multiple appliance vendors. The actor has previously exploited Citrix NetScaler (CVE-2023-4966) and a chain of Ivanti Connect Secure vulnerabilities (CVE-2023-46805, CVE-2024-21887 and later CVE-2025-0282). Volexity reported that UNC5221 had backdoored more than 2,100 Ivanti appliances using the GiftedVisitor webshell in attacks chaining CVE-2023-46805 and CVE-2024-21887.
What this means for technologists, government agencies, and enterprise buyers
- Technologists and security teams: Treat any internet-reachable BeyondTrust appliance running RS 26.2.3 or earlier as potentially compromised until reviewed and patched. Look specifically for the Sawfly web shell, Bareclaw tunneler indicators, SUID changes, wiped logs, and signs that Administrator credentials have been used to open remote sessions on downstream systems.
- Government agencies (including those previously targeted): Agencies that use BeyondTrust SaaS should confirm the October 8 patch was applied to their instances; self-hosted appliances require manual updates. Agencies that were targeted in prior campaigns (for example, the U.S. Treasury Department, OFAC, and CFIUS) should assume that credentials brokered by an appliance could have been exposed when an appliance reached root control.
- Enterprise procurement and IT leaders: BeyondTrust serves more than 20,000 customers worldwide, including government agencies and 75% of Fortune 100 companies. Buyers and operators must confirm update settings, inventory exposed appliances, and require post-compromise reviews where internet exposure occurred during the exploitation window.
Mandiant's blunt assessment — that any internet-reachable vulnerable appliance should be treated as potentially compromised — frames the core operational choice for defenders: immediate triage and review, or the continuing risk that credentials and persistent changes remain in adversary hands. Shadowserver's count of more than 1,400 exposed instances raises a concrete follow-up: how many remain unpatched or already compromised? The October 8 SaaS patch closed a key vector, but for self-hosted systems the work is still manual, and the history of repeated, successful exploitation of BeyondTrust and other edge appliances suggests defenders must move quickly.
