BeyondTrust Remote Support CVE-2026-102764 exploited by Armory Castle, patch now

What happened

BeyondTrust’s advisory BT26-05, issued 10/15/2026 and updated 11/4/2026, describes a critical flaw in Remote Support, tracked as CVE-2026-102764. It is an improper origin validation problem (CWE-290) in an internal messaging component. The component did not adequately validate the origin of the messages it received, so a remote attacker could perform file operations on an affected appliance. The CVSSv4 score is 9.3 (critical). BeyondTrust

Google warned that a suspected China state-sponsored actor it tracks as Armory Castle exploited the flaw in August 2026, before public disclosure. After exploitation the actor escalated privileges and kept persistent access to compromised Remote Support appliances. Infosecurity Magazine Cybersecurity News says Mandiant tied successful exploitation to late August 2026 and that the group was formerly tracked as UNC5221. It also says successful exploitation allowed arbitrary file uploads. Cybersecurity News

Reported post-exploitation activity by Armory Castle: Infosecurity Magazine

• Deployment of Sawfly, an obfuscated, lightweight PHP webshell with bidirectional encrypted command and control.
• Privilege escalation by copying the system shell to /usr/bin/dbus-authd, setting root ownership and enabling SUID, which gave a persistent root backdoor.
• Attempts to harvest credentials with the appliance’s native /ns/sbin/bt-secrets utility.
• Edits to configuration templates to grant passwordless root to the site service account.
• Changes that raised local Jump Items and Team permissions from No Access to Administrator, allowing remote sessions to downstream systems in the Jump Item list.
• Use of the Remote Support file transfer service to pull documents such as software inventories from user desktops.
• A tunneler called Bareclaw to move traffic through the device.
• Deletion of system, web server and application logs.

Patch timing: Infosecurity Magazine reports the patch was released October 8 for SaaS and self-hosted customers, and that BeyondTrust is withholding technical details while appliances are patched. Infosecurity Magazine BeyondTrust states that as of Oct 9, 2026 the patch had been applied to all Remote Support SaaS customers. BeyondTrust

Cybersecurity News reports that CISA’s October 16 alert confirms active exploitation and records the flaw’s addition to the Known Exploited Vulnerabilities catalog that day. Cybersecurity News The CISA alert itself was not among the provided sources.

On November 2, Cybersecurity News reported that Previdian saw two probes against decoy appliances in the United States and Europe, both from one Hong Kong-geolocated IP. The requests hit POST /api/start_session with the parameters issue_menu=1&id=1&c2cjs=1&platform=thin and resembled, but did not exactly match, a BeyondTrust Metasploit module under review. Previdian observed no successful exploitation, so mass scanning is a warning, not a confirmed finding. Cybersecurity News Google also warned that Armory Castle and other actors have historically carried out broad, opportunistic exploitation once a flaw becomes public. Infosecurity Magazine

Note: the request referenced CVE-2026-1731, but none of the sources use that identifier. The sources consistently use CVE-2026-102764, so a link to CVE-2026-1731 is not confirmed.

Am I affected?

• Self-hosted Remote Support, all versions up to and including 26.2.3: affected unless the patch has been applied. BeyondTrust
• Remote Support older than 24.3.1: the patch cannot be applied directly; you must upgrade to a newer version first. BeyondTrust
• Remote Support SaaS: BeyondTrust says the patch was applied to all SaaS customers as of Oct 9, 2026. BeyondTrust
• Exposure and prior compromise: exploitation began in August, before the October 15 disclosure, so an appliance patched late may already have been compromised. Internet-facing appliances are the main concern.

Signs to look for, per the reported activity and CISA guidance as relayed by Cybersecurity News: unknown privileged sessions, unexpected scripts, missing logs, unauthorized account or permission changes, a /usr/bin/dbus-authd file with SUID root, and Jump Item or Team permissions changed to Administrator. Cybersecurity News Infosecurity Magazine

What to do now

1. Preserve telemetry and logs first, so you keep an audit trail of possible attacker activity before you take containment steps. Infosecurity Magazine
2. Apply the BT26-05-RS patch (for 24.3.1 through 26.2.3) or move to Remote Support 26.3.1 or later. If you are on a version older than 24.3.1, upgrade first. Check whether your instance is subscribed to automatic updates in the /appliance interface. BeyondTrust
3. Limit external access and restrict the /login and /appliance administrative interfaces to trusted networks or IP ranges. Google suggests blocking inbound traffic to the appliance’s public address at the firewall, and denying outbound traffic except to BeyondTrust update and licensing endpoints while logging every denied connection. Cybersecurity News Infosecurity Magazine
4. Hunt for compromise using the indicators above, including the Sawfly webshell, the dbus-authd SUID file, bt-secrets use, changed Jump Item and Team permissions, and deleted logs.
5. If compromise is confirmed or unknown, isolate the appliance and redeploy from a clean, fully patched image or known-good state. Infosecurity Magazine Cybersecurity News
6. End all active support sessions, disable new sessions, and redeploy Jump Clients, Jumpoints and the representative console from the patched or rebuilt appliance to invalidate existing tokens. Infosecurity Magazine
7. Rotate appliance-managed credentials in dependency order, review new MFA registrations, and make sure the built-in Admin account uses MFA. Cybersecurity News Infosecurity Magazine
8. Monitor for requests to POST /api/start_session with the parameters reported by Previdian, remembering that this is a small sample and not proof of a widespread campaign. Cybersecurity News

Sources

• BeyondTrust, Security Advisory BT26-05 (official vendor advisory)
• Infosecurity Magazine, China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns
• Cybersecurity News, Critical BeyondTrust Vulnerability Faces Fresh Exploitation Probes as Hackers Prepare for Mass Scanning
• NVD record for CVE-2026-102764