BeyondTrust Zero-Day CVE-2026-102764 Gave Hackers Root Control

What happened

A suspected Chinese state-linked espionage group used an unknown flaw in BeyondTrust Remote Support to take over appliances. Defenders could not see the vulnerability for about seven weeks. On October 15, 2026, BeyondTrust published advisory BT26-05 for CVE-2026-102764, rating it critical with a CVSS 4.0 score of 9.3.1310 Google Threat Intelligence Group (GTIG) and Mandiant published their analysis the same day. They attribute the activity to ARMORY CASTLE, a suspected PRC-nexus actor that Mandiant previously tracked as UNC5221.12 Other trackers call the same cluster WARP PANDA.6 Dark Reading also ties it to UTA0178.

The bug sits in an internal messaging component that did not check where incoming messages came from. Under the right conditions, an attacker could use that gap to run file operations on the appliance.1 BeyondTrust classifies it as CWE-290, authentication bypass by spoofing.8 Its scoring describes a network-reachable attack with low complexity that needs no privileges and no user interaction.17 Mandiant says that in practice the flaw allowed arbitrary file uploads.12

This matters because of what the product does. BeyondTrust Remote Support, formerly sold as Bomgar, is the tool IT teams use to reach into and fix other machines across a company.12 Taking it over gives an attacker more than one server. Google's researchers warn that exploitation can lead to control of the host and "access to every credential the appliance stores or brokers."15

The timeline, and where accounts differ

BeyondTrust's timeline says the actor exploited the zero-day on August 29, 2026. It hit two targets: one BeyondTrust-hosted Remote Support instance and one self-hosted customer appliance.13 The discovery was indirect. On September 27, a successful attack on a different security-device vendor became public, and BeyondTrust began hunting through its own threat-intelligence data for similar activity.13 The company says it found the hosted compromise on September 28, hours after receiving a brief, non-specific warning from Mandiant.15 It reports containing that instance within 27 minutes of detection and reproducing the attack path in a lab within hours.8 Mandiant investigated the self-hosted compromise and confirmed BeyondTrust's findings on September 30.15

The patch reached customers on October 8, and SaaS instances of both Remote Support and Privileged Remote Access were updated automatically.13 Several outlets give October 9 as the date all SaaS tenants were covered.112 Dark Reading puts the patch's availability on October 9. These one-day differences look like the gap between the release date and the date every tenant was finished. They do not change what customers need to do.

The reporting differs more on scope. Some summaries describe the confirmed attack as hitting only a single self-hosted appliance.1 Others say self-hosted appliances were the confirmed target and suggest SaaS customers check their exposure directly with BeyondTrust.16 BeyondTrust's own account is more specific and, notably, less flattering to itself: one of the two confirmed victims was an instance BeyondTrust hosted.1314 One explainer describes weeks of looting "across affected environments."10 The public record does not support that framing. It confirms two compromised instances and documents one intrusion in detail. The rest of this analysis treats the confirmed number as two and the pattern of later attacks as a serious risk, not an established fact.

CISA has added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog, which gives federal civilian agencies until October 19, 2026, to patch.11 At least one outlet published before that update and could only say an addition was likely.16 Germany's BSI also issued its own advisory.10

Inside the intrusion

Mandiant's technical account shows an attacker who knew BeyondTrust's internals well. After exploiting the flaw, ARMORY CASTLE placed a lightweight PHP web shell called SAWFLY. The shell provided interactive access and encrypted command-and-control traffic in both directions.1 Mandiant observed it under the filename mangoapi.php.8 The shell first ran under a low-privilege service account. To get root, the attackers copied /bin/sh to /usr/bin/dbus-authd, gave the copy root ownership, and set its SUID bit.17

With root access, the group went after credentials. It used BeyondTrust's own bt-secrets command-line utility to try to pull passwords, API keys, and endpoint credentials from the appliance's built-in vault.1 It also erased entries from that utility's logs.4 Using compromised administrator credentials, it logged into the Remote Support portal and raised Jump Item and Team permissions from "No Access" to "Administrator."8 That let it open support sessions to internal machines, request full file-system access, and download documents useful for mapping the network.14

For lasting access, the group installed BARECLAW, a custom SOCKS5 tunneler written in C.1 It then edited the appliance's HAProxy configuration so that requests to a specific WebSocket path were forwarded to the tunneler on localhost. That kept the tunnel invisible to simple port scans while routing it through the appliance's normal HTTPS front end.17 The group also deleted system, web server, and application logs.3 It routed its traffic through commercial VPN exit nodes and hijacked home and small-office routers to blend in with ordinary traffic.1

GTIG researchers pointed to the group's use of proprietary command-line tools, startup configuration templates, and local reverse-proxy routing as evidence of deep familiarity with the appliance.1 One line from BeyondTrust's assessment stands out. The company believes the actor picks high-value software targets in advance and keeps a working model of those products in an AI context, which it uses continually to develop exploit chains.1

Why this is an espionage story, not a ransomware one

The campaign has none of the signs of financially motivated extortion. Reporting describes the group's approach as patient state tradecraft: get in quietly, collect credentials, and stay hidden, rather than encrypt systems for a ransom.10 ARMORY CASTLE has been active since at least October 2023. It has previously used zero-days in Citrix NetScaler and Ivanti Connect Secure against legal firms, SaaS providers, outsourcing companies, technology firms, and governments for long-term intelligence gathering.1 BeyondTrust also notes a 2025 Mandiant finding that the group took an Ivanti patch for a flaw rated low risk and turned it into working remote code execution.13

The ransomware risk is indirect, but it is real. Once a flaw like this is public, other criminals can reverse-engineer the patch. That is why Joe Toomey, who leads underwriting security at cyber insurer Coalition, told customers to patch "ASAP."15 BeyondTrust has withheld exploitation details, and no public proof-of-concept had appeared as of the initial advisories.17 That buys time, but how much is unclear.

The pattern that drives the warning

The most important part of the disclosure is BeyondTrust's description of how this actor behaves. It uses a zero-day sparingly against chosen targets while the flaw is secret, then exploits every unpatched instance once the flaw becomes public.15 Google's researchers make the same point, and Google has told organizations to prepare for "potential widespread exploitation."2 Beazley Security agrees, advising affected organizations to patch immediately and carry out a full review for signs of compromise.

BeyondTrust's remote-access products have drawn state hackers before. In December 2024, a China-linked group stole an API key for the Remote Support SaaS service and used it to breach the US Treasury.2 Earlier in 2026, a separate critical flaw in the same product, CVE-2026-1731, was exploited to plant backdoors.2 The disclosure also landed in a week when Ivanti, Cisco, and Palo Alto Networks all disclosed already-exploited flaws in their edge products.

The broader trend is a shrinking patch window. The IMF's latest financial stability report found that in more than 70% of 2026 cases, vendors had almost no time to patch before exploitation started, up 20 percentage points from the previous year.2

What defenders should do now

Patching is required but does not finish the job. Self-hosted Remote Support customers on versions 24.3.1 through 26.2.3 need to install BT26-05-RS or confirm that automatic updates already did. Customers on versions older than 24.3.1 must upgrade first.3 Privileged Remote Access shares the vulnerable code. BeyondTrust found no way to exploit it there but patched it as a precaution.5 SaaS customers do not need to patch the appliance. Mandiant says they still need to follow the credential and configuration steps.12

The patch blocks new exploitation but does nothing about a web shell, a SUID root binary, or credentials that were already stolen.8 For any appliance that was reachable from the internet during the exposure window, the safest approach is to assume compromise. Mandiant advises rebuilding suspicious appliances from a clean, fully patched image rather than cleaning them by hand.8 Hunting should look for:

• unexpected PHP files in web directories
• unfamiliar SUID binaries
• changes to HAProxy or sudoers templates
• sudden administrator role changes
• gaps in forwarded logs17

Mandiant has released indicators and YARA rules for its findings. It also warns that the group changes infrastructure and tools between victims, so hunting for behavior matters more than matching hashes.8

Appliances like this sit at the edge of the network while holding privileged access to everything behind it. For a group that studies its targets in advance and attacks every unpatched instance once a flaw goes public, they are very attractive.9 The two confirmed intrusions are probably not the full count of victims. Organizations that act as though they may be on the list will be best placed to limit the damage.