CVE-2026-102764: A Remote Support Appliance, a Web Shell, and a SUID Backdoor

Remote support software exists to let someone outside your network control a machine inside it. That is the product's purpose, not a compromise. CVE-2026-102764 turns that purpose into an attack path, and the reported post-exploitation behaviour reads like a textbook of what an appliance-based intrusion looks like.

The vulnerability

BeyondTrust disclosed an unauthenticated file operation flaw in Remote Support, classified under CWE-290 (improper validation of message origin) and rated 9.3. The reported consequence is that an unauthenticated remote attacker can perform arbitrary file operations on the appliance, which in testing was escalated to root-level command execution.

Affected versions per public reporting: Remote Support up to and including 26.2.3. Fixes are distributed as BT26-05-RS for versions 24.3.1 through 26.2.3, with installations below 24.3.1 requiring an intermediate upgrade. Privileged Remote Access shares affected code and received a preventive fix under BT26-05. SaaS deployments were remediated by the vendor.

CISA added the CVE to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of 19 October 2026.

The reported intrusion

Public analysis attributes exploitation to a tracked cluster, referred to as ARMORY CASTLE and also as UNC5221 or Warp Panda, beginning around 29 August 2026 — before the vulnerability was publicly disclosed.

Reported objectives are more specific than a generic compromise:

Deployment of a PHP web shell with encrypted bidirectional command and control, referred to as SAWFLY.
Installation of a SUID backdoor for privilege retention.
Theft of the appliance's credential store, reported as bt-secrets.
Modification of Jump Item permissions.

That last item is the one that distinguishes this from a typical edge-appliance compromise. Jump Items are the configuration that defines which machines a support session can reach. Altering them changes who gets access to what, using the product's own trusted mechanism.

Why the credential store matters more than the shell

A web shell gives an attacker a place to stand. The credential store gives them a way to walk.

Remote support platforms hold credentials and trust relationships for the endpoints they reach. An attacker with those can authenticate legitimately, as the appliance, to systems that never see the intrusion coming. The behaviour looks like normal remote support.

That is also why removing the web shell is insufficient. If the credential store was read, the recovery requirement is rotation of every secret it held, not deletion of a file.

Modification of Jump Item permissions compounds this: even after credential rotation, a deliberately misconfigured Jump Item remains an access path until someone reviews the configuration against policy.

Detection and response

Given the reported mechanism and objectives, the practical work is:

Version verification. Confirm the appliance build against BT26-05-RS coverage. Installations below 24.3.1 need the staging upgrade first, which lengthens the maintenance window and should be planned, not discovered.
Configuration review. Compare Jump Item definitions against the last approved baseline. New or widened permissions require explanation.
Credential rotation. Rotate the appliance credential store and any account whose secrets it held. This includes service accounts used for endpoint authentication.
File system review on the appliance. Look for PHP content in directories that should not contain executable web content, and for SUID binaries that are not part of the shipped image.
Network review. Outbound connections from the appliance to destinations not associated with vendor infrastructure are the primary indicator of an active implant.
Assume pre-disclosure exposure. Exploitation reportedly began in late August, well before disclosure. Any exposure timeline should start from the earliest date the appliance was internet-reachable, not from the publication date.

Step six is the one most often missed. Disclosure dates anchor incident scoping in a way that systematically under-scopes intrusions found to be exploited as zero-days.

The class of problem

Appliance-based intrusions share a common shape: a network-reachable management product, a pre-authentication flaw, and a post-exploitation phase that uses the product's own trust to move laterally.

That shape means the appliance's configuration is as much an incident artifact as its logs. Jump Items, access policies, linking accounts and integration secrets all describe what the attacker could have done, and they are all recoverable facts if the device is preserved.

Preserve first. Rebuild second. Rotate always.