BeyondTrust customers have more than a patching problem on their hands. A suspected China-linked espionage group exploited a critical Remote Support flaw as a zero-day, then gained root access, attempted to harvest stored credentials, and accessed downstream systems, according to Mandiant.
Google warned that ARMORY CASTLE exploited CVE-2026-102764 in late August and could broaden attacks now that the bug is public. BeyondTrust rates the flaw critical at 9.3 and says Remote Support versions 26.2.3 and earlier are affected. SaaS customers were patched by Oct. 9, while self-hosted customers need to verify that BT26-05-RS has been installed.
China-linked hackers turned remote support into root access
Reuters reported that Google and Mandiant tied the August exploitation to ARMORY CASTLE, a suspected China-linked threat group. Successful exploitation gave the attackers access to credentials, allowed arbitrary file uploads, and opened the door to control of the affected host.
The Hacker News, citing Mandiant, reported that the attackers deployed the SAWFLY PHP webshell and escalated privileges to root. They also tried to harvest credentials from BeyondTrust’s native secrets database and changed Remote Support permissions to access downstream systems. The attackers later deployed the BARECLAW tunneler and deleted system, web server, and application logs to make detection harder.
For defenders, the concern is not limited to the appliance itself. Remote Support is designed to give administrators access to other endpoints, so a compromised server can become a route into systems already trusted by the organization.
CVE-2026-102764 affects Remote Support 26.2.3 and earlier
BeyondTrust said CVE-2026-102764 is an improper origin validation flaw in an internal messaging component. Under the right conditions, a remote attacker can use it to perform file operations on an affected appliance. The company rates the vulnerability critical, with a CVSS v4.0 score of 9.3.
All Remote Support versions through 26.2.3 are affected. BeyondTrust said it had applied the patch to all SaaS customers by Oct. 9. Self-hosted customers running versions 24.3.1 through 26.2.3 should apply BT26-05-RS or verify that automatic updates installed it. Customers on older releases must upgrade before applying the patch.
BeyondTrust also recommends a precautionary patch for self-hosted Privileged Remote Access appliances because they share affected code. The company said testing had not identified a way to exploit the vulnerability in that product
Patching is only the first step
Google warned that public disclosure could lead to broader opportunistic exploitation, making exposed BeyondTrust appliances a higher-priority target.
Infosecurity Magazine noted that organizations with suspected exposure should preserve telemetry before making changes and may need to rebuild appliances when compromise is confirmed or cannot be ruled out.
For security teams, installing BT26-05-RS closes the vulnerability but does not undo activity that may have already occurred.
ARMORY CASTLE demonstrated that attackers could use a compromised Remote Support appliance to obtain privileged credentials, establish persistence, and reach systems managed through the platform. An organization therefore needs to determine whether the appliance was exploited before the patch was installed.
Security teams should prioritize three actions:
- Verify patch status: Confirm that self-hosted Remote Support appliances have received BT26-05-RS. Systems running versions older than 24.3.1 need to be upgraded before the patch can be applied.
- Hunt for compromise: Review privilege changes, missing logs, altered proxy or startup settings, suspicious administrator permissions, and signs of SAWFLY or BARECLAW. Teams should also examine whether unexpected remote sessions or file transfers occurred.
- Contain affected systems: Restrict appliance traffic, end active support sessions, rotate exposed credentials, and rebuild from a clean patched image when compromise is confirmed or cannot be ruled out.
The risk can extend beyond the Remote Support appliance itself. The product can broker privileged access to other endpoints, so stolen credentials or persistent administrator access could give attackers a path into additional systems even after the original vulnerability is patched.
For organizations that had an internet-facing appliance running an affected version during the exploitation window, the safer response is to treat patching and compromise assessment as separate tasks. Confirm the fix first, then determine whether attackers gained access before it was installed and whether credentials, sessions, or downstream systems also need remediation.
Related reading: China-linked espionage campaigns are also targeting governments across Asia. Cisco Talos tied UAT-11587 to an 11-month operation using the Antino backdoor, cloud infrastructure, and Microsoft 365 for command and control.