VulnSocial
← Back to blog

CVE-2026-102764 – Critical Authentication Bypass Enables Unauthenticated RCE in BeyondTrust Remote Support

Key takeaways:

  • CVE-2026-102764 is a Critical authentication bypass in BeyondTrust Remote Support, added to the CISA KEV on October 16, 2026, confirming active exploitation.
  • An unauthenticated attacker can perform file operations on the appliance, achieving Remote Code Execution (RCE) without any prior credentials.
  • ARMORY CASTLE (fka UNC5221), a Chinese espionage actor, has been observed exploiting this zero-day in the wild, achieving persistence, privilege escalation, and lateral movement.
  • BeyondTrust's own sensors fired high-severity alerts, but an automated third-party triage system closed them as false positives—a critical detection engineering lesson.
  • Apply vendor patch BT26-05 immediately; follow CISA BOD 26-04 guidance for prioritization.

Overview

On October 15, 2026, BeyondTrust disclosed a critical authentication bypass in its Remote Support (RS) platform—a tool used by IT support teams to remotely troubleshoot and administer endpoints. The flaw was disclosed to the CISA Known Exploited Vulnerabilities (KEV) Catalog on October 16, 2026, confirming active exploitation. Mandiant and Google Threat Intelligence subsequently published technical analysis documenting that the espionage actor ARMORY CASTLE (fka UNC5221) exploited the zero-day in the wild.

Technical Details

The vulnerability stems from inadequate validation of message origins within internal components of BeyondTrust Remote Support. Under the right conditions, an attacker can spoof or intercept messages and perform arbitrary file operations on the appliance without authentication. This culminates in unauthenticated Remote Code Execution (RCE), enabling full control of the appliance.

The underlying weakness maps to CWE-290: Authentication Bypass by Spoofing. The CVSS v3.1 base score is 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H—indicating network-accessible, low attack complexity, no privileges required, no user interaction, and complete compromise of confidentiality, integrity, and availability.

Severity & Impact

The score reflects a straightforward but devastating path: an internet-facing appliance becomes fully compromised without any foothold. Attackers have demonstrated post-exploitation behavior including SAWFLY PHP webshells, privilege escalation from service accounts to root, attempted credential vault extraction, persistent passwordless root access, systematic log deletion, and lateral movement via BARECLAW WebSocket/SOCKS5 tunneler. BeyondTrust's own sensors detected the escalation, but a third-party automated triage system incorrectly closed the alerts as false positives.

For key indicators, exploit activity over time, and detailed signal data, see the CVE page.

Affected Products

This vulnerability affects BeyondTrust Remote Support across all current versions. For the full list of affected products and versions, see CVE page.

Actionable Insights

  • Treat as a live threat. With active exploitation confirmed and CISA KEV listing, every exposed instance is a potential target.
  • Audit detection gaps. The BeyondTrust incident shows sensors firing alerts that were auto-closed. Review your alert triage pipelines—especially automated rules that dismiss high-severity signals as "false positives."
  • Monitor for post-exploitation indicators. Look for SAWFLY webshells, credential vault extraction attempts, persistent root sessions, log deletion, and BARECLAW tunneling on any appliance you operate.
  • Check your telemetry coverage. If your sensors are not surfacing these signals, they are not useful even if they fire. Detection engineering requires active hunting, not just alert generation.

Remediation & Mitigation

  1. Apply vendor patch BT26-05 immediately. This is the primary fix.
  2. Follow CISA BOD 26-04 guidance. Prioritize patching based on asset exposure; discontinue use if mitigations are unavailable.
  3. Inventory and assess exposure. Identify all appliances with Remote Support enabled and internet-facing.
  4. Validate detection coverage. Confirm your alerting surfaces these attack patterns before the next exploitation wave.
  5. Maintain incident response readiness. Given active exploitation by state-sponsored actors, assume compromise may already exist in some environments.

References

#CVE #Critical #RCE #CISAKEV #BeyondTrust #RemoteSupport #DetectionEngineering #ThreatIntel #ARMORYCASTLE #StateSponsored #ZeroDay