BeyondTrust — Armory Castle Exploits Remote Support Zero-Day Vulnerability (CVE-2026-102764)

Publication date: October 16, 2026
Category: Zero-Day / Vulnerability

Introduction

In late August 2026, the China-nexus cyber espionage group tracked as Armory Castle (formerly known as UNC5221 or Warp Panda) executed a targeted campaign leveraging a zero-day security flaw within BeyondTrust Remote Support (formerly Bomgar). Officially tracked as CVE-2026-102764, this critical vulnerability allowed the threat actor to compromise self-hosted appliances, deploy lightweight PHP web shells, harvest native administrative credentials, and establish silent tunnels for long-term intelligence gathering across critical sectors such as technology, legal services, and government entities.

What is CVE-2026-102764? (General Analysis)

The CVE-2026-102764 vulnerability exists within the internal messaging components of BeyondTrust Remote Support. According to official data verified in the National Vulnerability Database (NVD), the flaw stems from the application’s failure to adequately validate the origin of incoming messages. Under the proper execution conditions, this allows an unauthenticated remote attacker to perform unauthorized file operations directly on the affected appliance.

• Official CVSS v4.0 Score: 9.3 (CRITICAL)
• Official CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (Confirmed fact by NVD)
• Official CWE Classification: CWE-290 (Authentication Bypass by Spoofing) (Confirmed fact by NVD)
• CISA KEV Catalog: Not listed in the active catalog at the time of analysis.

This type of vulnerability poses an extreme operational risk, as perimeter appliances typically bridge external networks with internal administrative environments, making them prime targets for initial access.

How Does It Work? (Technical Analysis)

Armory Castle’s campaign exemplifies a disciplined approach: selective use of a zero-day against high-value targets prior to public disclosure, followed by opportunistic wide-scale exploitation once patches are released. The intrusion lifecycle involves several advanced phases:

• Initial Influx / Exploit Entry: The threat actor exploits improper origin validation in internal messaging components by sending crafted requests via exposed endpoints, executing arbitrary file operations to establish a foothold.
• Persistence & Privilege Escalation: Upon successful compromise, operators deploy a lightweight PHP web shell codenamed SAWFLY for interactive remote access and bidirectional encrypted command-and-control. Root-level privileges are later achieved by copying the system shell (/bin/sh) to /usr/bin/dbus-authd, changing its ownership to root, and setting the Set User ID (SUID) permission.
• Credential Harvesting & Lateral Movement: Attackers abuse the native /ns/sbin/bt-secrets CLI utility to extract stored passwords, API keys, and endpoint credentials directly from the appliance’s database. Configuration templates are modified to grant passwordless root access to site service accounts, followed by reconnaissance pivoting through the appliance’s Jump Item list.
• Evasion & Communication Tunnelling: To mask traffic, operators install BARECLAW, a custom C-based SOCKS5 proxy tunneler that relays TCP connections between remote clients and internal destinations, modifying /ns/config/haproxy.conf for direct internet accessibility. Detection is actively hindered by systematically erasing system, web server, and application logs.

Affected Systems / Environments

The primary impact affects organizations operating self-hosted deployments of BeyondTrust Remote Support, compounded by the group’s historical targeting of edge devices.

• Vulnerable BeyondTrust Versions: Self-hosted customer installations running versions 24.3.1 through 26.2.3. Versions older than 24.3.1 require a prerequisite upgrade before applying fixes.
• Target Profiles: Managed Service Providers (MSPs), legal firms, business-process outsourcers, technology companies, and government institutions.

Mitigation and Detection

Remediation

• Immediate Patching: BeyondTrust has deployed automated patches for SaaS customers and released the BT26-05-RS patch for self-hosted instances. Upgrading must be treated as an urgent priority.
• Forensic Review: Any self-hosted appliance reachable from the internet on a vulnerable version during the exposure window must be treated as potentially compromised until thoroughly audited.

Detection

• File & Process Monitoring: Inspect system directories for modified binaries such as /usr/bin/dbus-authd with SUID permissions and search for indicators of the SAWFLY PHP web shell.
• Network Traffic Analysis: Monitor for anomalous connections related to the BARECLAW SOCKS5 proxy tunneler and unauthorized adjustments to /ns/config/haproxy.conf.

“The actor uses a zero-day selectively against chosen targets, and once the vulnerability is public, the actor typically moves to broad exploitation of every instance still unpatched.”

Wrapping Up

The exploitation of CVE-2026-102764 in BeyondTrust Remote Support by Armory Castle emphasizes the persistent threat posed by state-sponsored cyber espionage campaigns. By combining deep internal knowledge of software architecture with modular tooling like web shells and custom proxy tunnels, threat actors successfully bypass traditional perimeters. Rapid patch management and comprehensive forensic reviews of exposed edge devices remain essential countermeasures for defensive teams.

References

• BeyondTrust. (2026). Security Advisory: BT26-05 Remote Support Vulnerability. https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
• BeyondTrust. (2026). Timeline of Events: BT26-05 Advisory Details. https://www.beyondtrust.com/blog/entry/bt26-05
• BeyondTrust Documentation. (2026). Jump Item list configuration and management. https://docs.beyondtrust.com/pra/v24.3/docs/wac-jump-items
• National Vulnerability Database (NVD). (2026). NVD Detail - CVE-2026-102764. U.S. National Institute of Standards and Technology (NIST). https://nvd.nist.gov/vuln/detail/CVE-2026-102764
• National Vulnerability Database (NVD). (2023). NVD Detail - CVE-2023-4966. U.S. National Institute of Standards and Technology (NIST). https://support.citrix.com/article/CTX579459
• National Vulnerability Database (NVD). (2024). NVD Detail - CVE-2023-46805 & CVE-2024-21887. U.S. National Institute of Standards and Technology (NIST). https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways
• National Vulnerability Database (NVD). (2025). NVD Detail - CVE-2025-0282. U.S. National Institute of Standards and Technology (NIST). https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283