Nobody typed a password. Nobody approved a push. Nobody sat on a helpdesk call. According to BleepingComputer, citing Mandiant, ARMORY CASTLE (also tracked as UNC5221 and Warp Panda) began exploiting CVE-2026-102764 against BeyondTrust Remote Support on 29 August 2026. The flaw is an authentication bypass by spoofing (CWE-290) in an internal messaging component on versions ≤26.2.3. Unauthenticated attackers could perform file operations on internet-reachable appliances. Mandiant observed one hosted and one self-hosted instance compromised in that zero-day window, while Shadowserver tracked more than 1,400 BeyondTrust Remote Support instances exposed online.
How CVE-2026-102764 opened the appliance with no login
CVE-2026-102764 scored CVSSv4 9.3. It failed origin validation so a remote caller could spoof trust inside the product’s internal messaging path and run file operations without authenticating. There was no password challenge, no OTP, no push, and no session cookie to steal first. Workforce MFA on a corporate IdP, VPN, or helpdesk portal never entered the picture, because the product never asked who was calling.
BeyondTrust patched Remote Support and Privileged Remote Access SaaS around 8-9 October 2026. Self-hosted customers needed BT26-05-RS. CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities catalog on 16 October 2026 with a federal remediation due date of 19 October. BeyondTrust stated that internal testing had not found a way to exploit the issue in Privileged Remote Access, yet PRA shares the affected code, so the vendor shipped that patch out of caution and told self-hosted PRA customers to apply it immediately.
This is not the first rough week for the product family. The same reporting wave covers earlier Remote Support and Privileged Remote Access ransomware activity tied to critical RCE CVE-2026-1731, and a prior Silk Typhoon campaign that abused BeyondTrust SaaS API-key exposure against Remote Support cloud instances, including the U.S. Treasury Department. ARMORY CASTLE’s own résumé already includes mass edge-appliance zero-day work against Ivanti Connect Secure in early 2024, when Volexity reported GiftedVisitor webshells across more than 2,100 appliances. The pattern is familiar: internet-facing support gear, unauthenticated remote code or file control, then a short path to host ownership.
BeyondTrust serves over 20,000 customers worldwide, including 75% of Fortune 100 companies, according to the same BleepingComputer coverage. Public reporting has identified only the two appliances Mandiant described and has not named other end-customer victims or published affected record counts.
SAWFLY, root, vault attempts, and what survived reboot
After the unauthenticated foothold, the actors uploaded the SAWFLY webshell as mangoapi.php. From the web service account they escalated to a SUID root shell on the appliance host. Mandiant’s reporting is blunt on what root meant: access to every credential the appliance stored or brokered, plus the ability to modify files that survive reboot and configuration reset. They installed the BARECLAW tunneler for durable remote control and wiped logs to slow responders.
With root, they attempted credential-vault extraction using bt-secrets. Sources do not confirm that full vault dumps succeeded. Even without a confirmed dump, a rooted remote-support appliance is a credential factory. It brokers administrator secrets, support-session material, and whatever the vault held for jump targets. Mandiant’s guidance matches that reality: any appliance reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed.
| Stage | What attackers did | What authentication faced |
|---|---|---|
| Initial access | Origin-spoof file ops via CVE-2026-102764 | None; unauthenticated bypass |
| Host control | SAWFLY, SUID root, BARECLAW, log wipe | Host already owned |
| Secret access | bt-secrets vault extraction attempts | Server-side store after root |
| Lateral use | Admin console login, Jump Item elevation | Stolen Administrator secrets |
None of that first three rows is an MFA prompt failure. The product authentication surface was skipped by design of the bug. Secrets were read from a compromised host store, not typed into a fake login page and not coaxed out of a helpdesk agent.
Administrator console credentials and Jump Item sessions
The chain did not stop at the appliance. Actors used compromised Remote Support Administrator credentials inside the legitimate admin console. From there they raised privileges on Jump Items and opened endpoint support sessions for lateral movement and file transfer. That step is ordinary product functionality pointed the wrong way: a support console that is supposed to reach managed endpoints becomes a highway once the attacker holds administrator secrets taken off the rooted box.
Public sources do not describe whether that admin console enforced any MFA, what type it was, or whether hardware-bound factors were required. If the console only checked a reusable administrator password or another recoverable secret, replaying those secrets after appliance compromise is enough. Stronger console authentication would not have closed CVE-2026-102764 or removed root-level secret access already achieved. It could still have blocked a password-only replay into the console and slowed Jump Item elevation. Operators cleaning up should patch and rebuild the appliance path first, then assume administrator material may already be in hostile hands and force console re-authentication with non-replayable factors where the product allows it.
Share of the 1,400-plus internet-exposed instances that were actually hit remains unreported. Honeypots versus production boxes are not broken out. PRA in-the-wild exploitation of this specific CVE is not established in the sources. Confirmed successful full vault dumps are not established either. What is established is the operator’s worst case for edge remote-support gear: unauthenticated file write, webshell, root, tunneler, log destruction, then legitimate console features driven with stolen administrator credentials.
If you want to skip the attack details and go straight to what can still harden admin-console and Jump Item login after an appliance compromise like this, read the related article on mfa2point0.com: BeyondTrust RS admin console MFA after appliance bypass.
FAQ
Did attackers need a password or MFA code to exploit BeyondTrust Remote Support?
No. CVE-2026-102764 let unauthenticated remote attackers perform file operations on BeyondTrust Remote Support appliances ≤26.2.3 by spoofing origin checks in an internal messaging component. According to Mandiant reporting summarized by BleepingComputer, ARMORY CASTLE used that path as a zero-day from 29 August 2026 without completing a normal login.
What is SAWFLY and why did root on the appliance matter?
SAWFLY is the webshell (mangoapi.php) Mandiant tied to post-exploit activity on compromised BeyondTrust Remote Support hosts. After the webshell, actors escalated from the web service account to a SUID root shell, installed the BARECLAW tunneler, and wiped logs. Root exposed every credential the appliance stored or brokered and let them change files that survive reboot and configuration reset.
Did the attackers empty the BeyondTrust credential vault?
Public reporting says actors attempted credential-vault extraction with bt-secrets. Successful full vault dumps have not been confirmed in the sources covering this BeyondTrust Remote Support campaign. Operators should still treat internet-exposed vulnerable appliances as potentially credential-compromised until reviewed, per Mandiant’s stated guidance.
How did Jump Item lateral movement happen after the appliance breach?
After host control, the actors used compromised Remote Support Administrator credentials in the legitimate admin console, raised Jump Item privileges, and opened endpoint support sessions for lateral movement and file transfer. Sources do not name the console’s MFA configuration. That step reused product admin features and stolen secrets; it was not the CVE itself.
Is this the same BeyondTrust incident as Silk Typhoon or CVE-2026-1731 ransomware?
No. Silk Typhoon’s earlier BeyondTrust activity centered on SaaS API-key abuse and different CVEs against Remote Support cloud instances. CVE-2026-1731 is a separate critical RCE path in Remote Support and Privileged Remote Access tied to ransomware reporting. CVE-2026-102764 is the origin-spoofing authentication bypass exploited as a zero-day by ARMORY CASTLE against appliances, with SAWFLY, root, and admin-console Jump Item follow-on described by Mandiant.
