A SUID flip rooted the BeyondTrust appliance

BeyondTrust shipped a fix on Thursday for CVE-2026-102764, an authentication bypass in its Remote Support product that attackers have been exploiting since late August. The flaw lets an unprivileged remote attacker perform file operations on an unpatched appliance, and it affects Remote Support 26.2.3 and earlier.

BeyondTrust patched its SaaS customers on October 8, covering both Remote Support and Privileged Remote Access. Self-hosted installations are on their own: they have to be patched manually unless automatic updates are enabled.

Mandiant and Google Threat Intelligence Group, which caught the initial attacks, attribute them to a suspected China-nexus espionage group they track as Armory Castle, formerly UNC5221. CrowdStrike tracks the same actor as Warp Panda. The group used the bypass to get in, then escalated to root on the appliance by enabling SUID permissions. From there it deployed a web shell Mandiant calls Sawfly and a tunneler it calls Bareclaw, wiped logs to evade detection, and moved laterally with compromised Administrator credentials, opening remote sessions on downstream systems.

Why a file-operation bug becomes a full breach

The damage follows from what the appliance holds.

After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host. This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset.

The device’s job is brokering privileged access, so root on it hands the attacker that function along with every secret it keeps. The note about files surviving reboot and configuration reset matters for cleanup: a reset will not evict the persistence.

A familiar actor and a familiar second phase

Armory Castle has a consistent target profile: zero-days in internet-facing edge appliances. Mandiant ties it to Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805 and CVE-2024-21887, later CVE-2025-0282) going back to at least October 2023. Volexity reported in January 2024 that the same group had backdoored more than 2,100 Ivanti appliances with its GiftedVisitor web shell by chaining two of those Ivanti bugs.

Mandiant expects the same pattern to repeat here.

In past campaigns, ARMORY CASTLE has conducted widespread and opportunistic exploitation following the public disclosure of vulnerabilities it had exploited selectively as zero-days, racing to infiltrate target organizations before patches are deployed. It is possible that we will observe similar widespread exploitation attempts associated with CVE-2026-102764.

If that holds, the quiet, selective targeting since August gives way to mass scanning now that the CVE is public.

CVE-2026-102764 adds to a run of BeyondTrust appliance flaws used in real attacks. Recently CVE-2026-1731, a critical RCE in Remote Support and Privileged Remote Access, was used to open WebSocket channels and deploy ransomware. Last year the Chinese state-backed group Silk Typhoon is believed to have chained CVE-2024-12356 and CVE-2024-12686 to breach BeyondTrust itself, then used a stolen API key to reach 17 Remote Support SaaS instances, including the U.S. Treasury’s, along with OFAC, which runs U.S. sanctions programs, and CFIUS, which reviews foreign investment for national security risk. BeyondTrust serves more than 20,000 customers, including 75% of the Fortune 100, which is why edge appliances like this keep drawing the same class of actor.

What to do

Mandiant is blunt about the cleanup question:

Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed.

Patching closes the door but does not remove an attacker who already reached root. Treat every credential the appliance stored or brokered as exposed and rotate it, and assume a configuration reset will not clear persistence. Shadowserver counts more than 1,400 Remote Support instances exposed online, without saying how many are already patched or are honeypots, so the exposed population from the exploitation window is at least that order of magnitude.

See also: NordVPN for tunneled traffic when operating outside controlled networks.

---

#ad Contains an affiliate link.