Skip to content
Hacker Posts

BeyondTrust patches Remote Support zero-day exploited since August

CVE-2026-102764 (CVSS 9.3) let a China-nexus actor Mandiant calls Armory Castle take over self-hosted BeyondTrust Remote Support appliances from August 29. Patch now.

Published 3 min read
cvebeyondtrustzero-dayadvisorychina

BeyondTrust has patched CVE-2026-102764, a flaw in its Remote Support appliance (formerly Bomgar) that a China-nexus espionage group exploited as a zero-day from August 29, 2026. The bug is rated CVSS 9.3. If you run a self-hosted Remote Support appliance that was internet-reachable during the exploitation window, treat it as potentially compromised — not merely patched.

The primary sources are BeyondTrust's security advisory and the incident analysis from Google Threat Intelligence Group (GTIG) / Mandiant, reported by The Record and The Hacker News.

What the bug does

CVE-2026-102764 is an improper origin-validation flaw in an internal messaging component. BeyondTrust's wording: the component "did not adequately validate the origin of the messages it received." A remote attacker can abuse it to perform file operations on the appliance — the foothold the operators turned into root.

Affected versions and patch

  • Self-hosted 24.3.1 through 26.2.3: apply the BT26-05-RS patch manually.
  • Self-hosted older than 24.3.1: no patch for your branch — upgrade to a fixed release.
  • SaaS customers: BeyondTrust says these were patched as of October 9, 2026. No action required.

Exploitation status

Confirmed, and not opportunistic. BeyondTrust first exploitation was observed on August 29 against a single self-hosted appliance; the company opened its investigation on September 27, after exploitation of another edge-appliance vendor became public.

Mandiant attributes the activity to Armory Castle, a China-nexus group it also tracks as UNC5221 (aka Warp Panda). BeyondTrust says it concurs with Mandiant's assessment that this is a state-sponsored espionage operation focused on long-term collection. Keep the hedge in mind: this is a vendor-plus-Mandiant attribution, not a court filing. GTIG notes the same cluster has previously burned zero-days in Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282).

Per GTIG, post-exploitation on compromised appliances involved:

Web shell:     SAWFLY (lightweight PHP, encrypted C2)
Root escalation: /bin/sh copied to /usr/bin/dbus-authd, chowned root, SUID set
Cred theft:    proprietary /ns/sbin/bt-secrets CLI utility
Tunneling:     BARECLAW (C-based SOCKS5 proxy)
Exposure:      /ns/config/haproxy.conf modified to expose BARECLAW to the internet
Anti-forensics: system, web server and application logs deleted

GTIG published full indicators and detection rules in its report; the above are the named artifacts it called out. Infrastructure blended in through commercial VPN exit nodes and compromised SOHO routers.

What to do today

  1. Patch. Apply BT26-05-RS on self-hosted 24.3.1–26.2.3 now; upgrade off anything older. SaaS is already done.
  2. Assume compromise if you were exposed. GTIG advises treating any internet-reachable appliance that ran a vulnerable version during the window as potentially compromised "until it has been reviewed." A patch does not evict an attacker already inside.
  3. Hunt the artifacts. Check for a SUID /usr/bin/dbus-authd, unexpected processes tied to the site service account, modifications to /ns/config/haproxy.conf, and gaps in appliance logs.
  4. Rotate secrets. The bt-secrets harvesting means stored credentials and session material for downstream systems should be treated as exposed. Rotate keys, service-account passwords, and any credentials the appliance could reach.
  5. Pull the vendor report. Ingest GTIG's IOCs and detection content into your SIEM/EDR before closing the ticket.

Context

This is the second China-nexus edge-appliance zero-day we've covered this week, after the Ivanti Connect Secure chain disclosed October 13. The pattern is consistent: a remote-access or VPN appliance sitting at the perimeter, a quiet months-long dwell, and a vendor advisory that lands only after a separate incident forces the investigation. The lesson operators keep relearning is that "patched" and "not compromised" are different states for anything exposed to the internet.

Related stories