BeyondTrust Remote Support Root Escalation via CVE-2026-102764
Armory Castle exploited a critical flaw to gain root access on appliances, prompting urgent patching advice from Google and BeyondTrust.
Key points
- Armory Castle exploited CVE-2026-102764 to establish persistent root access on BeyondTrust appliances in August 2026.
- BeyondTrust released patches on October 8 but withheld technical details to protect customers still applying updates.
- Google warned that opportunistic exploitation is likely following the public disclosure of the critical vulnerability.
Google warned that the China-aligned espionage group Armory Castle exploited a critical vulnerability in BeyondTrust Remote Support. The actor used the flaw to gain persistent root access on customer appliances before public disclosure.
What happened
Armory Castle was observed exploiting CVE-2026-102764 in August 2026 to escalate privileges on BeyondTrust Remote Support instances. The group deployed Sawfly, an obfuscated PHP webshell with encrypted command and control capabilities. Attackers copied the system shell executable to /usr/bin/dbus-authd and modified its ownership to root. They enabled Set User ID permissions on the file to create a persistent backdoor. This technique granted the actors continuous root-level access to the compromised host system.
Why it matters
BeyondTrust disclosed the vulnerability on October 15 with a CVSS rating of 9.3. A patch was available for SaaS and self-hosted customers since October 8. The vendor withheld specific technical details to reduce risk while customers applied updates. Google urged immediate patching, noting that actors historically exploit such flaws broadly once disclosed. Armory Castle has targeted legal, technology and government sectors since October 2023.
Next steps
- Verify if your BeyondTrust Remote Support instances are running the patched version.
- Check for unauthorized modifications to system binaries or SUID permissions.
- Monitor for unusual outbound connections from appliance management interfaces.
- Review logs for the deployment of unknown PHP scripts or webshells.
Detection notes
Security teams should monitor for unexpected changes to system binary permissions, particularly SUID bits on non-standard executables. Look for new PHP files in web directories or unusual outbound traffic from management appliances. Check for processes spawned by web servers that persist after user sessions end. Analyse file integrity monitoring alerts for modifications to core system directories. Review authentication logs for privilege escalation events originating from web contexts. Containment involves isolating affected appliances and revoking compromised credentials.
What to do and how to stay safe: BeyondTrust
- Apply the October 8 patch to all BeyondTrust Remote Support instances immediately.
- Scan network logs for connections to known malicious command and control infrastructure.
- Audit file permissions on critical system binaries for unauthorized SUID modifications.
- Monitor for the presence of the Sawfly webshell or similar obfuscated scripts.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this BeyondTrust vulnerability?
The vulnerability is identified as CVE-2026-102764.
When was the patch released for this flaw?
BeyondTrust released the patch on October 8 for SaaS and self-hosted customers.
Which threat actor exploited this vulnerability?
The suspected China-aligned group Armory Castle exploited the flaw.
