BeyondTrust Remote Support Zero-Day Allows Unauthenticated Root Access
A critical flaw in self-hosted appliances enables unauthenticated attackers to gain root control and access stored credentials, prompting urgent patching.
Key points
- CVE-2026-102764 allows unauthenticated file operations leading to host-level control.
- The flaw affects Remote Support versions up to 26.2.3 with a CVSS 4.0 score of 9.3.
- A patch was released on October 8 for self-hosted customers to apply immediately.
Self-hosted BeyondTrust Remote Support appliances face immediate risk from a critical zero-day vulnerability that grants unauthenticated attackers root access. Mandiant and Google Threat Intelligence Group reported that the ARMORY CASTLE espionage group exploited this flaw in late August to establish footholds and access credential vaults.
Root cause
The vulnerability, identified as CVE-2026-102764, allows an unauthenticated attacker to perform file operations. Mandiant stated this leads to host-level control and access to every credential the appliance stores or brokers. The Common Vulnerability Scoring System 4.0 rates the severity at 9.3, reflecting the high impact of gaining full control over the appliance and its stored data.
Attack path
Attackers begin by sending malicious requests to the exposed appliance. Within minutes, they deploy a PHP web shell known as SAWFLY into the web root. To escalate privileges, the threat actor copies the /bin/sh binary to /usr/bin/dbus-authd, changes the owner to root, and sets the SUID bit, thereby achieving persistent root-level control.
Affected versions
- Remote Support versions up to 26.2.3 are affected.
- The flaw impacts self-hosted appliances and one BeyondTrust-hosted instance.
- CVE-2026-102764 is the specific identifier for this vulnerability.
Mitigation
- Apply the patch released by BeyondTrust on October 8 immediately.
- Treat all exposed self-hosted appliances as potentially compromised.
- Monitor for unauthorized file changes in the web root.
- Review logs for suspicious privilege escalation attempts.
Detection notes
Security teams should monitor for unexpected file modifications in web directories, particularly the appearance of PHP scripts. Watch for processes copying system binaries or changing permission bits like SUID. Alert on unusual outbound connections from remote support appliances. Check whether automated triage tools are suppressing high-severity alerts. Verify that no unknown users have gained root access.
What to do and how to stay safe: BeyondTrust
- Update all self-hosted Remote Support instances to the latest patched version.
- Audit file integrity on appliances to detect unauthorized web shells.
- Review access logs for unauthenticated requests followed by privilege escalation.
- Isolate compromised systems to prevent lateral movement within the network.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of BeyondTrust Remote Support are vulnerable?
Versions up to 26.2.3 are affected by CVE-2026-102764.
Is there a patch available for this zero-day?
Yes, BeyondTrust released a patch on October 8.
Who is responsible for exploiting this vulnerability?
The ARMORY CASTLE espionage group, formerly tracked as UNC5221, is attributed with the exploitation.
