BeyondTrust Remote Support CVE-2026-102764 Was Exploited for 47 Days Before Disclosure, and Its Own Alerts Were Closed as False Positives

An unauthenticated remote attacker can perform file operations on a BeyondTrust Remote Support appliance, and a suspected China-nexus group used that to take root on at least one self-hosted appliance starting August 29. BeyondTrust disclosed CVE-2026-102764 on October 15, and CISA added it to its Known Exploited Vulnerabilities catalogue on October 16.

All supported Remote Support versions up to 26.2.3 are affected. The company says the cause is internal components that do not adequately validate the origin of incoming messages, according to BankInfoSecurity. None of the pages fetched for this story states a CVSS score for the flaw.

Timeline of CVE-2026-102764

The dates come from three sources and do not fully agree, which is flagged below.

Date	Event	Source
August 29	Earliest compromise BeyondTrust has dated	BankInfoSecurity
September 28	BeyondTrust first discovers the exploit	BankInfoSecurity
September 30	Mandiant reviews the self-hosted compromise	BankInfoSecurity
October 8 or 9	SaaS tenants patched	BleepingComputer says 8; Google says 9
October 15	Public disclosure and Google report	Google Threat Intelligence Group

That is 30 days between the first compromise and BeyondTrust's discovery, and 47 days from the first compromise to disclosure.

The alerts that were closed

BeyondTrust's own third-party attack-detection platform flagged signs of the attack, then labelled them false positives and did not escalate them for human review, BankInfoSecurity reports. BeyondTrust says it is working with that vendor so automated triage cannot close high-severity signals on its own.

The report does not name the detection vendor, and neither does Google's.

What Armory Castle did on the appliance

Google Threat Intelligence Group and Mandiant track the actor as Armory Castle, formerly UNC5221; CrowdStrike calls it Warp Panda, per BleepingComputer. Google labels it suspected PRC-nexus espionage and says the tooling aligns with earlier activity rather than giving a confidence level for the attribution.

Mandiant's report lists the steps. A PHP web shell called SAWFLY appeared at the web root about 11 minutes after the first malicious POST. The actor then copied /bin/sh to /usr/bin/dbus-authd, made it root-owned with the SUID bit set, and read the appliance vault with the /ns/sbin/bt-secrets command.

Persistence was a startup script, zz-root-persist, that appends a passwordless sudoers line to the template so it survives reboots and configuration resets. A tunneller called BARECLAW listened on TCP 19800, bound to localhost and exposed through an edited HAProxy rule at the path /uidchanarge, which keeps it invisible to external scans.

With stolen Administrator credentials the actor raised a Jump Item role from No Access to Administrator, opened remote sessions on downstream machines and pulled documents such as software inventories through the file-transfer service.

Patching, and the order that matters

SaaS customers need no appliance action. Self-hosted appliances on 24.3.1 or later take patch BT26-05-RS from /appliance or confirm auto-update; older ones must upgrade first. Mandiant warns that upgrading closes the hole but "does not remediate prior exposure."

The report's less obvious instruction is about sequencing: "Rotate credentials only after the appliance has been patched or rebuilt. Rotating earlier exposes the new credentials to an attacker who still controls the appliance." Because customers cannot audit the appliance host file system, Mandiant recommends rebuilding from a clean image rather than cleaning.

Exposure and the Ivanti precedent

Shadowserver tracks more than 1,400 exposed BeyondTrust remote support instances and does not say how many are patched. Joe Toomey, vice president of underwriting security at Coalition, was quoted by BankInfoSecurity as saying, "If you run BeyondTrust Remote Support, you should patch ASAP," and warned that attackers may use an LLM to reverse engineer the patch.

The same actor has a record on edge appliances: Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282), where Volexity counted more than 2,100 backdoored appliances in January 2024. CISA's catalogue is moving at three-day deadlines, and the week's other exploited Atlassian file-read flaw gives defenders the same short window. Mandiant says it is possible that similar widespread exploitation attempts will follow this disclosure.