BeyondTrust Remote Support Vulnerability (CVE-2026-102764) Under Exploitation

The Threat

On October 15th, 2026, BeyondTrust disclosed a critical zero-day vulnerability within their Remote Support application, tracked as CVE-2026-102764 (CVSS: 9.3). The vulnerability exists within the internal components of Remote Support, where the components do not validate the origins of received messages, enabling attackers to perform file uploads on impacted appliances.

Along with the disclosure, BeyondTrust published a blog indicating that exploitation of CVE-2026-102764 was traced back to August 2026, attributed to the suspected Chinese APT ARMORY CASTLE (aka UNC5221, Warp Panda), and leveraged to deploy custom webshells and tunneling tools. As exploitation has been identified, organizations that utilize BeyondTrust Remote Support should ensure that relevant patches are applied immediately.

What we're doing about it

• eSentire MDR for Network has detections in place to identify traffic associated with the deployment of the SAWFLY webshell and BARECLAW tunneler, reported as a post-compromise payloads
• eSentire MDR for Log detections are in place to identify post-compromise activity
• eSentire's Managed Vulnerability Service (MVS) will add relevant plugins as they become available
• eSentire customers can employ the Vulnerabilities and Inferred Vulnerabilities pages in Atlas Portal to search for potentially vulnerable assets
• eSentire's Threat Response Unit (TRU) is performing threat hunts across customer environments for known Indicators of Compromise (IoCs)
  • Impacted customers will be contacted by the eSentire SOC
• TRU is tracking this topic for additional information and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches immediately
  • Relevant updates have been applied to all Remote Support Software-as-a-Service (SaaS) customers
  • Self-hosted Remote Support customers must manually apply the patch if they are not subscribed to automatic updates
• Where possible, restrict access to administrative interfaces to trusted IP Addresses or network segments only

Additional information

Google Threat Intelligence Group (GTIG) and Mandiant published a technical report, detailing the exploitation of CVE-2026-102764. The attack was attributed to ARMORY CASTLE with suspected espionage motivations. Post-exploitation activity included establishing persistence, privilege escalation, credential harvesting, lateral movement, and the deployment of custom malware, including the SAWFLY webshell and BARECLAW tunneler. The attackers also performed anti-forensic measures, including deletion of system, web server, and application-level logs, in order to "impair defenses and hinder detection".

GTIG assesses that widespread exploitation of CVE-2026-102764 may be observed following the vulnerability's disclosure, noting that ARMORY CASTLE, and other threat actors, have "historically conducted broad, opportunistic exploitation" once a vulnerability becomes public. At the time of writing, there are no reports of publicly available Proof-of-Concept (PoC) exploit code, which can also be a signal for possible widespread exploitation.

As exploitation has been ongoing since at least August 2026, organizations that utilize BeyondTrust Remote Support within their environment should ensure that relevant patches are applied as soon as possible. BeyondTrust states that patches have been applied for SaaS customers, but for self-hosted customers that do not have automatic updates enabled, the patch will need to be manually applied. If exploitation is suspected, organizations should review relevant logs for unrecognized privileged or administrative sessions, unknown script files, unauthorized account, permission, or policy changes, and unexpected gaps in log forwarding. If a compromise is found, network traffic to the appliance should be blocked at the firewall level, and devices should be rebuilt from a known clean, fully patched image.

References

[1] https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
[2] https://nvd.nist.gov/vuln/detail/cve-2026-102764
[3] https://www.beyondtrust.com/blog/entry/bt26-05
[4] https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust