CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

This vulnerability (CVE-2026-102764) in BeyondTrust Remote Support platform versions 26.2.3 and earlier enables unauthenticated remote attackers to bypass authentication controls and perform arbitrary file operations. Confirmed exploitation in the wild includes deployment of the SAWFLY web shell and BARECLAW tunneler, root privilege escalation, attempts to extract credentials from vaults, establishing persistence, and deleting logs to cover tracks. The attacks have been linked to ARMORY CASTLE, a suspected PRC-nexus espionage actor. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed this vulnerability as known exploited, underscoring the urgency for organizations to apply emergency patches and conduct thorough investigations for compromise.

The vulnerability allows unauthenticated remote attackers to bypass authentication and perform arbitrary file operations, leading to full system compromise including root escalation, credential theft, persistence, and log deletion. Confirmed exploitation in the wild has resulted in deployment of advanced malware and tunneling tools, indicating a high risk of espionage and data breach. The persistence mechanisms mean that patching alone does not remove attacker footholds, requiring incident response and remediation beyond patch application.

Organizations must apply emergency patches provided by BeyondTrust for versions 26.2.3 and earlier immediately. Since patching does not remove attacker persistence, affected environments should be thoroughly investigated for signs of compromise, including presence of SAWFLY web shell, BARECLAW tunneler, and other indicators of compromise. Incident response actions should include credential vault audits, root access reviews, and log integrity checks. Follow vendor advisories and CISA guidance for detailed remediation steps.