Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild
Summary
BeyondTrust confirmed two Remote Support compromises involving CVE-2026-102764, an authentication bypass affecting versions 26.2.3 and earlier. A patch is available; organizations should patch urgently and investigate for prior compromise.
Key points
- The unauthenticated flaw allows remote attackers to perform file operations without user interaction; it is rated CVSSv4 9.3.
- BeyondTrust confirmed two compromises dating to August 29, 2026: one hosted instance and one self-hosted appliance.
- Mandiant reported arbitrary file uploads, SAWFLY web shell and BARECLAW tunneler deployment, root escalation, attempted credential-vault extraction, persistence, and log deletion.
- Mandiant attributes the activity to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221.
- Remote Support 26.2.3 and earlier are affected unless patched. Apply BT26-05-RS; older deployments must upgrade to a supported version before patching.
- BeyondTrust said all Remote Support SaaS customers were patched as of October 9, 2026. Self-hosted Privileged Remote Access shares the affected code, but the vendor has not identified a way to exploit the flaw in PRA.
- Patching does not remove persistence. Rapid7 recommends investigating even after patching; Mandiant advises preserving evidence, isolating suspected appliances, and rebuilding if compromise is confirmed or cannot be ruled out.
Article Details
- Vulnerability Types
- Authentication bypass by spoofing
- Inadequate validation of the origin of incoming messages
- Severity
- Critical; CVSSv4 9.3
- Affected Versions
- BeyondTrust Remote Support 26.2.3 and earlier, unless BT26-05-RS has been applied
- BeyondTrust Privileged Remote Access (PRA), affected code is shared; exploitability has not been identified by the vendor
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462 | SHA-256 hash identified by Mandiant for the BARECLAW tunneler. |
| SHA256 | dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb | SHA-256 hash identified by Mandiant for the SAWFLY PHP web shell. |
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationMandiant reported root escalation after exploitation.T1105 · Ingress Tool TransferMandiant reported arbitrary file uploads to compromised Remote Support appliances.T1190 · Exploit Public-Facing ApplicationUnauthenticated remote attackers exploited the Remote Support authentication bypass on exposed appliances.T1505.003 · Web ShellMandiant reported deployment of the SAWFLY PHP web shell.T1555 · Credentials from Password StoresMandiant reported attempted extraction of a credential vault.T1562.002 · Disable Windows Event LoggingMandiant reported log deletion during the compromise.
CVE
Threat Actors
Malware
BARECLAWMandiant's investigation describes arbitrary file uploads, deployment of the SAWFLY PHP web shell and BARECLAW tunneler, root escalation, attempted credential-vault extraction, persistence, and log deletion. MandiantSAWFLYMandiant's investigation describes arbitrary file uploads, deployment of the SAWFLY PHP web shell and BARECLAW tunneler, root escalation, attempted credential-vault extraction, persistence, and log deletion. Mandiant
Vendors
Products
BeyondTrust Privileged Remote AccessNote: BeyondTrust also recommends immediate patching of self-hosted Privileged Remote Access (PRA) because it shares the affected code. The vendor has not identified a way to exploit this vulnerability in PRA. PRABeyondTrust Remote SupportOn October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS), its platform for remotely troubleshooting and administering endpoints. Tracked as CVE-2026-102764 and assigned a CVSSv4