Active Exploitation | Zero-Day | Critical | CVSS 9.3 | CVE-2026-102764
Source Material: BeyondTrust BT26-05, Google Threat Intelligence Group | Technology: BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) | Targeted Industries: Opportunistic
Executive Summary
BeyondTrust disclosed CVE-2026-102764, a critical improper-origin-validation vulnerability (CWE-290) in an internal messaging component of Remote Support (RS). BeyondTrust rates the issue CVSS v4 9.3 and states that a remote attacker could perform file operations on an affected appliance. Available intelligence reporting indicates limited active exploitation of this flaw as a zero-day against selected BeyondTrust Remote Support appliances before public disclosure.
Self-hosted Remote Support customers should apply the BT26-05-RS patch immediately. BeyondTrust also released a precautionary PRA patch because PRA shares affected code, although BeyondTrust states its internal testing has not identified a way to exploit this CVE in PRA. SaaS customers were automatically patched according to BeyondTrust; customers should still validate service status and investigate suspicious activity.
If exploitation is suspected, preserve appliance and off-box logs, isolate the appliance as operationally feasible, treat all credentials stored or brokered by the appliance as exposed, rotate them, and contact BeyondTrust support using a Sev 1 request that cites BT26-05.
Threat Overview and Strategic Impact
Initial zero-day activity was reportedly observed on August 29, 2026, targeting both cloud-hosted and on-premise Remote Support appliances. Following internal investigation and reproduction of the attack vector in late September, BeyondTrust deployed patches on October 8 and coordinated public disclosure on October 15, 2026.. Public reporting attributes the activity with moderate to high confidence to a China-nexus threat actor. Attribution is assessed from observed tradecraft and may not generalize to every exploitation event.
Available intelligence reporting indicates that the actor used the compromised appliance as a privileged foothold. Investigators observed webshell deployment, attempts to extract credentials from the BeyondTrust vault, abuse of administrative sessions, changes to Jump Item and Team permissions, file transfer from user desktops, and tunneling through the appliance. The reported tooling includes the SAWFLY webshell and BARECLAW tunneler.
CVE-2026-102764 is an actively exploited zero-day based on available reporting. CISA KEV inclusion was not confirmed in the sources reviewed for this advisory; organizations should prioritize remediation based on the confirmed exploitation evidence rather than wait for catalog status.
BeyondTrust Remote Support versions 26.2.3 and earlier are affected by CVE-2026-102764. While vendor testing has not identified an active exploitation path in Privileged Remote Access (PRA), PRA shares affected code. SaaS instances for both Remote Support and PRA were automatically patched by BeyondTrust.
Security Hardening and Recommendations
- Identify every self-hosted Remote Support and Privileged Remote Access appliance, installed version, public exposure path, and patch status.
- Apply BT26-05 immediately. If immediate patching is not possible, restrict appliance access to trusted administrative networks, remove unnecessary internet exposure, and limit outbound connectivity to required destinations. These measures reduce risk but do not replace patching.
- Remote Support: Apply BT26-05-RS patch for versions 24.3.1 through 26.2.3. Appliances running versions older than 24.3.1 must first be upgraded to a supported release before applying the security patch.
- Privileged Remote Access: Apply the precautionary PRA patch to self-hosted appliances.
- SaaS Instances: Validate service and patch completion status with BeyondTrust and conduct compromise assessment for activity preceding the patch window.
- Forward appliance syslog and session events to a SIEM over a protected channel, retain records for a multi-month lookback, and collect reverse-proxy, WAF, firewall, and identity-provider logs.
- If compromise is suspected, preserve a forensic image and relevant logs before rebuilding when operationally feasible. Rotate every credential, password, API key, and endpoint credential stored or injected by the appliance; review non-managed-session use and new MFA registrations.
- Review and revalidate administrator accounts, Jump Items, Teams, session policies, outbound event destinations, syslog settings, API accounts, and security-provider configuration after remediation.
Detection Strategy
Threat infrastructure and tooling are frequently rotated during exploitation, as a result, effective detection strategies should focus on durable behavioral analytics rather than relying solely on static indicators.
Detecting this activity should prioritize key behavioral anomalies, including:
- Anomalous Authentication & Access: Successful administrative logins originating from residential broadband or commercial VPN address spaces, as well as privileged sessions initiated outside expected change windows.
- Execution & Persistence: Web service accounts spawning interactive shells, alongside new or modified script files created within web directories.
- Privilege Escalation & Account Manipulation: Jump Item or Team permission increases, creation of new API accounts, and file-transfer activity.
- Defense Evasion & Logging Tampering: Modifications to syslog or outbound-event destinations, and log-forwarding gaps bounded within a single session.
Supplemental detection efforts include monitoring for specific file artifacts identified in recent intrusion activity, as detailed in the Technical Artifacts section below, though these artifacts are trivial for threat actors to change, hence the importance of behavioral detections.
How Deepwatch Protects Our Customers
Deepwatch Adversary Tactics & Intelligence is analyzing emerging intelligence and exploitation telemetry associated with CVE-2026-102764. Deepwatch SOC Guardians are continuously monitoring customer environments for suspicious authentication, unauthorized administrative access, command execution, and post-exploitation activity across relevant endpoint, identity, firewall, proxy, and network telemetry. Customers are encouraged to prioritize exposure assessment, patching, and compromise validation for affected BeyondTrust Remote Support appliances.
Relevant Detections
Please visit the Guardian Platform to access the relevant detections for this activity and ask NEXA Detection Advisor for a breakdown of which detections are enabled in your environment.
Threat Hunting Leads
- Search appliance and reverse-proxy logs for unexpected paths, unknown .php files, WebSocket upgrades from untrusted sources, suspicious administrative logins, and sessions originating from residential or commercial VPN networks.
- Hunt for references to /ns/sbin/bt-secrets, attempts to access the appliance credential vault, deletion of bt-secrets.log or archived copies, and shell execution by web service accounts.
- Review user_changed, user_added, api_account, and security_provider events for unapproved changes, especially Jump Item and Team permission changes.
- Correlate file-transfer activity and sessions started by accounts whose permissions changed during the exposure window.
- Investigate unexpected log-forwarding interruptions that begin and end within one session as potential anti-forensics.
Technical Artifacts
Please visit the Guardian Platform to access available technical artifacts for this report.
Threat Object Mapping
Intrusion Set:
- Warp Panda/Armory Castle
Attack Pattern (MITRE ATT&CK/MITRE ATLAS):
| Tactic | Technique | Technique ID | Associated Threat Activity |
| Initial Access | Exploit Public-Facing Application | T1190 | Exploitation of an internet-reachable BeyondTrust appliance. |
| Credential Access | Unsecured Credentials / Credentials from Password Stores | T1552/T1555 | Attempts to extract credentials from the appliance vault. |
| Persistence | Account Manipulation | T1098 | Modification of administrative permission to Jump Items and Teams. |
| Command and Control | Proxy | T1090 | BARECLAW tunneling through the compromised appliance. |
| Exfiltration | Exfiltration Over Web Service / Remote Services | T1567/T1021 | Execution of file transfer and appliance-mediated access. |
Vulnerabilities:
- CVE-2026-102764 (CWE-290; CVSS v4 9.3 Critical).
Malware/Tool:
- SAWFLY webshell; BARECLAW tunneler.
Additional Sources
CVE Record for CVE-2026-102764: https://www.cve.org/CVERecord?id=CVE-2026-102764
BeyondTrust Security Advisory BT26-05: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
BeyondTrust ARMORY CASTLE and BT26-05: https://www.beyondtrust.com/blog/entry/bt26-05
Google Threat Intelligence Group, ARMORY CASTLE Exploits BeyondTrust: https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/
↑
Share