China-Linked Hackers Exploit Critical BeyondTrust Remote Support Zero-Day Vulnerability to Compromise Appliances

Severity
Critical

BeyondTrust has disclosed a critical zero-day vulnerability affecting its Remote Support (RS) appliances, which has been actively exploited by a China-linked cyber espionage group known as Armory Castle, previously tracked as UNC5221 or Warp Panda. The vulnerability, identified as CVE-2026-102764, carries a CVSS score of 9.3 (Critical) and could allow remote attackers to perform unauthorized file operations on affected appliances.

The vulnerability originates from improper origin validation within BeyondTrust Remote Support’s internal messaging components. Under certain conditions, attackers can exploit this weakness to manipulate files on vulnerable appliances, potentially leading to unauthorized administrative access and further compromise of connected enterprise systems.

According to BeyondTrust, the threat actor exploited the vulnerability as a zero-day on August 29, 2026, targeting a self-hosted Remote Support appliance before the security flaw was publicly disclosed. The attack demonstrates the threat actor’s capability to exploit previously unknown vulnerabilities in enterprise remote access infrastructure.

Following successful exploitation, attackers deployed a lightweight PHP web shell known as SAWFLY, enabling persistent remote access and encrypted command-and-control (C2) communication. The attackers subsequently escalated privileges, obtained administrative control, and attempted to extract sensitive information, including stored credentials, API keys, and endpoint authentication details.

Further investigation revealed that the attackers leveraged compromised administrator credentials to initiate remote support sessions to internal endpoints, facilitating lateral movement and potential data exfiltration. They also deployed a custom SOCKS5 proxy tool known as BARECLAW to tunnel network traffic through compromised appliances and deleted system and application logs to evade detection.

BeyondTrust confirmed that security patches were deployed to all Remote Support SaaS customers by October 9, 2026. However, self-hosted deployments remain at risk if the required security updates have not been applied. Given the active exploitation and potential exposure of privileged credentials, internet-facing appliances running vulnerable versions should be prioritized for immediate remediation and security investigation.

CVE ID	Summary	CVSS Score
CVE-2026-102764	A critical improper origin validation vulnerability in BeyondTrust Remote Support’s internal messaging components that could allow remote attackers to perform unauthorized file operations on affected appliances, potentially enabling further system compromise.	9.3 (Critical)

Affected Products

The vulnerabilities affect the following BeyondTrust products:

BeyondTrust Remote Support (RS) – Self-hosted versions 24.3.1 through 26.2.3.
BeyondTrust Remote Support (RS) – Versions earlier than 24.3.1 require an upgrade to a supported version before the security patch can be applied.

BeyondTrust Remote Support SaaS deployments were patched by the vendor as of October 9, 2026.

Recommendation

Organizations using affected BeyondTrust Remote Support appliances are strongly advised to apply the BT26-05-RS security patch immediately. Self-hosted deployments running versions 24.3.1 through 26.2.3 should install the applicable patch, while older versions must be upgraded to a supported release before remediation.

Organizations should also review internet-facing Remote Support appliances for indicators of compromise, particularly suspicious administrative activities, unauthorized remote sessions, unexpected file modifications, and unusual outbound network connections. Security teams should investigate potential credential exposure, rotate affected privileged credentials where necessary, and review access to connected internal systems.

As the vulnerability has been actively exploited, organizations should not rely solely on patching. Any vulnerable appliance exposed to the internet during the exploitation period should undergo a security assessment to identify possible unauthorized access, persistence mechanisms, or lateral movement.

Source

https://thehackernews.com/2026/10/china-linked-hackers-exploited.html

https://www.beyondtrust.com/trust-center/security-advisories/bt26-05