Cybersecurity news flagged the BeyondTrust zero-day CVE-2026-102764 (BT26-05) in October 2026. This 3-question check places you in or out of the exposed cohort, then gives the upgrade sequence that closes it fastest.
Your remote-support appliance is the keys to the kingdom — it can reach every system your admins touch, and it stores privileged credentials. On October 15, 2026, BeyondTrust disclosed a critical BeyondTrust zero day (CVE-2026-102764, CVSS 9.3) that a suspected espionage actor had been exploiting since August 29. The BeyondTrust security advisory BT26-05 closes the hole — but only for people who actually apply it. Answer three questions and get your verdict.
You are in the exposed cohort if you run self-hosted BeyondTrust Remote Support at 26.2.3 or earlier without the BT26-05-RS patch confirmed. The zero-day (CVE-2026-102764, CVSS 9.3) was exploited August 29, 2026 by suspected espionage actor ARMORY CASTLE, and CISA set a binding remediation due date of October 19. SaaS tenants were patched October 9 — but must rotate credentials.
Answer honestly. Your verdict updates the moment all three are answered. Defensive check only — nothing here touches your network.
Sources: SecurityWeek · SOCRadar · CVE Threat Brief · XHack
Tick each box as you complete it. Your progress updates live.
Per Mandiant's analysis of the August 29 exploitation: about 11 minutes after entry, the attacker dropped the mangoapi.php SAWFLY web shell, created a SUID copy of the system shell to become root, dumped the credential vault, added a boot-time persistence script with a passwordless sudo rule, and wiped local logs. Then, using a compromised administrator account, it raised Jump Item and team roles to Administrator, opened support sessions to internal endpoints, pulled documents through built-in file transfer, and tunneled out via the BARECLAW tunneler.
mangoapi.php — SAWFLY web shell (and app_84304470%2Ephp staging paths in web logs)ingredi_ws in /tmp — BARECLAW tunneler listening on TCP 19800, path /uidchanarge/usr/bin/dbus-authd — unexpected root-owned SUID shell copy/home/bomgar/sbin/post_boot.d/zz-root-persist — boot persistence adding passwordless sudowebskd3, ACL wswsws routing /uidchanarge to 127.0.0.1:19800user_changed events raising Jump Item roles to Administrator without a change ticketSources: Censys advisory · XHack · SOCRadar · GBHackers · Security Signal Weekly · CVE Threat Brief
— Mandiant researchers now give the actor a name: the likely Chinese government-backed espionage group it previously tracked as UNC5221 is now called ARMORY CASTLE (also tracked by CrowdStrike as Warp Panda / UTA0178). Alongside the naming comes a fuller picture of the group's behavior inside the compromised appliances: after landing the zero-day, it showcased privilege escalation, lateral movement — "hop around the compromised network" — and detection-evasion tactics.
Armory Castle's track record is a pattern of sweeping attack sprees against edge and remote-access appliances:
Active since October 2023, the group targets technology, legal services, SaaS providers, business-process outsourcers and government bodies — sectors chosen for long-term intelligence collection. Its playbook is consistent: exploit a zero-day in an internet-facing appliance narrowly and quietly against high-value targets, then pivot to broad, opportunistic exploitation once the vulnerability goes public. Mandiant's warning stands: "prepare for potential widespread exploitation." GTIG senior analyst Kelli Vanderlee adds that "we are aware of only a small number of impacted organizations at this time, but given the stealth of the activity, and the use of a zero-day, it is possible that additional organizations were also compromised prior to the disclosure."
Honest scope: "likely Chinese government-backed" is Mandiant and Google Threat Intelligence Group's attribution assessment, not a confirmed government link. The BeyondTrust AI-model-of-targets claim (the actor keeping an AI model of its target products to build exploit chains) is BeyondTrust's working assessment, not an independently verified finding.
Sources: CyberScoop · CSO Online · Dark Reading · The Record / Breached
If a three-question exposure check is useful, imagine a platform that hunts breach indicators like SAWFLY and BARECLAW across your stack automatically. BreachHunter by Ingenious AI is one of our 11 AI security platforms.
Get BreachHunter early access →Our platforms return November 1 — WhatsApp gets you in line now.
Browse the full library: all checks & tools · See the platform overview: Ingenious AI security suite
BT26-05 (CVE-2026-102764) is a BeyondTrust zero-day disclosed in October 2026 — a vulnerability attackers could exploit before a patch existed, making unpatched deployments the exposed cohort.
BT26-05 is the BeyondTrust security advisory published October 15, 2026 for CVE-2026-102764, a critical BeyondTrust zero-day vulnerability (CVSS 4.0 9.3, CWE-290 improper origin validation) in BeyondTrust Remote Support. It lets an unauthenticated attacker perform file operations on the appliance, which attackers turned into root access.
Yes. BeyondTrust and Mandiant report CVE-2026-102764 was exploited as a zero-day starting August 29, 2026 against one BeyondTrust-hosted and one self-hosted Remote Support instance by the suspected China-nexus espionage actor ARMORY CASTLE, which deployed the SAWFLY web shell and BARECLAW tunnel, escalated to root, and wiped logs.
All BeyondTrust Remote Support versions 26.2.3 and earlier are affected. The BT26-05-RS patch covers versions 24.3.1 through 26.2.3; appliances older than 24.3.1 must upgrade first, then apply the patch. A version number alone does not confirm the patch is present.
CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities (KEV) catalog on October 16, 2026 with a binding remediation due date of October 19, 2026 and flagged forensic triage as required for potentially exposed appliances.
No. The BT26-05-RS patch closes the entry point, but an appliance that was internet-reachable during the August 29 to October 8 window may already be compromised. CISA's KEV listing flags forensic triage as required: hunt the Mandiant indicators, preserve encrypted appliance logs, rotate the credential vault, and rebuild through BeyondTrust support rather than just deleting a web shell.
Armory Castle is Mandiant's name (October 2026) for a suspected China-nexus espionage group it previously tracked as UNC5221 — also tracked by CrowdStrike as Warp Panda / UTA0178 — active since October 2023. It specializes in zero-day exploitation of edge and remote-access appliances: Ivanti defects repeatedly since 2023, the CitrixBleed NetScaler zero-day, last year's Brickstorm campaign (average attacker dwell time ~400 days), and now the BeyondTrust CVE-2026-102764 zero-day. Once inside, it escalates privileges, moves laterally, and evades detection.
Informational only — not a substitute for your incident-response team or BeyondTrust support. Facts cited per BeyondTrust advisory BT26-05 (Oct 15, 2026), the CISA KEV catalog, and linked secondary reporting. Built by Ingenious AI.