BeyondTrust disclosed CVE-2026-102764 on October 15, a CVSS 9.3 flaw in Remote Support. Google's Mandiant says a suspected China-nexus espionage actor was already exploiting it as a zero-day, with attacks beginning in late August 2026. The sources cited here are BleepingComputer, The Hacker News and Mandiant's reporting.
Mandiant attributes the activity to ARMORY CASTLE, previously tracked as UNC5221. CrowdStrike tracks the same actor as Warp Panda. That puts roughly six weeks between first exploitation and public disclosure.
The flaw is described as improper origin validation in an internal messaging component. It affects supported Remote Support versions through 26.2.3. Outlets differ on the label: one calls it an authentication bypass, another an unauthenticated file upload. Both describe the same attack path.
Per the reporting, the attackers uploaded a file, then moved from an unprivileged web service account to root. They created /usr/bin/dbus-authd from the system shell, set root ownership and enabled the SUID bit. The implant is a PHP web shell called SAWFLY, which uses custom Base32 encoding and RC4 to exchange commands and results. Reports also describe a tunneler named Bareclaw, log erasure and lateral movement with stolen credentials.
Why it matters. Remote Support appliances sit at a privileged chokepoint: they hold credentials and reach into internal networks. Root on one gives an attacker a trusted foothold that most monitoring ignores. Google warns that public disclosure raises the odds of broad exploitation by other actors.
BeyondTrust patched Remote Support and Privileged Remote Access SaaS customers on October 8. Self-hosted installations must be patched manually unless automatic updates are enabled.
Recommended actions:
Patch self-hosted Remote Support now and confirm the running version is above 26.2.3.
Hunt for /usr/bin/dbus-authd, especially with root ownership and the SUID bit set, and for unexpected PHP files in web directories.
Review web service account activity and appliance logs back to late August. Expect gaps, since the actor erased logs.
Rotate credentials stored on or reachable from the appliance. If compromise is confirmed, rebuild the appliance rather than clean it, and treat any credential it held as exposed.
Restrict internet exposure of the appliance to what remote support operations strictly require.
