privilege escalation Archives

Overview

CVE-2026-102764 is a critical authentication bypass vulnerability affecting BeyondTrust Remote Support appliances. This flaw allows a remote, unauthenticated attacker to perform arbitrary file operations on the vulnerable appliance. It has been added to CISA’s Known Exploited Vulnerabilities Catalog, indicating active exploitation by sophisticated threat actors, including those linked to ARMORY CASTLE.

Technical Analysis

The vulnerability (CWE-290, Improper Neutralization of Special Elements used in an Authentication Bypass) resides within internal components of BeyondTrust Remote Support. These components fail to adequately validate the origin of received messages, enabling an attacker to spoof legitimate communications. Under specific conditions, this spoofing allows an unauthenticated remote attacker to execute file operations on the appliance, potentially leading to arbitrary code execution, privilege escalation to root, and the deployment of backdoors or webshells.

CVE ID: CVE-2026-102764
CVSS 3.1 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: BeyondTrust Remote Support versions up to and including 26.2.3.
Attack Vector: Network (AV:N), requiring low attack complexity (AC:L) with no privileges (PR:N) or user interaction (UI:N).
Impact: High confidentiality, integrity, and availability impact (C:H/I:H/A:H).
Observed Exploitation: Actively exploited in the wild by threat actors, including ARMORY CASTLE, to achieve root access and deploy malware such as SAWFLY and BARECLAW.

Detection

Detection efforts should focus on anomalous activity originating from or targeting BeyondTrust Remote Support appliances, particularly suspicious file operations or process execution.

Network Logs: Monitor for unusual network traffic patterns to/from BeyondTrust appliances, especially unexpected connections or data transfers post-exploitation.
Appliance Logs: Review system logs on BeyondTrust appliances for:
- Unusual process creation by the BeyondTrust service (e.g., sh, bash, python, perl, cmd.exe, powershell.exe spawned by the main BeyondTrust process).
- Suspicious file modifications or creations in web root directories (e.g., /var/www/html, /opt/beyondtrust/web/) indicative of webshell deployment.
- Changes to system configuration files or new user accounts being created.
- Attempts to modify or delete log files.
Endpoint Detection and Response (EDR): On systems interacting with or hosting the BeyondTrust appliance, look for:
- Execution of known malware families like SAWFLY or BARECLAW.
- Unusual outbound connections from the appliance to external C2 infrastructure.
- Privilege escalation attempts or suspicious persistence mechanisms being established.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

BeyondTrust Remote Support – Suspicious Process Creation

title: BeyondTrust Remote Support - Suspicious Process Creation
id: 9a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious process creation by the BeyondTrust Remote Support service, indicative of post-exploitation activity after CVE-2026-102764 exploitation. This could include shell execution or other arbitrary commands.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'EXECVE'
    a0|contains: ['sh', 'bash', 'python', 'perl', 'php', 'nc', 'wget', 'curl']
    # Adjust 'comm' or 'exe' based on the actual BeyondTrust service process name on the appliance
    # Example: comm: 'beyondtrust_service' or exe|endswith: '/opt/beyondtrust/bin/service'
    # For broader detection, you might omit the parent process if logs are limited.
  condition: selection
level: high

BeyondTrust Remote Support – Suspicious File Write in Web Root

title: BeyondTrust Remote Support - Suspicious File Write in Web Root
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects suspicious file writes in common web root directories on a BeyondTrust appliance, potentially indicating webshell deployment after CVE-2026-102764 exploitation.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'SYSCALL'
    syscall: 'openat'
    a1: 'O_WRONLY|O_CREAT'
    # Common web root paths for appliances. Adjust based on actual BeyondTrust appliance structure.
    name|startswith: ['/var/www/', '/opt/beyondtrust/web/', '/usr/share/nginx/html/', '/usr/local/apache2/htdocs/']
    # Look for common webshell extensions or suspicious file names
    name|endswith: ['.php', '.jsp', '.asp', '.aspx', '.pl', '.py', '.sh', '.cgi', '.txt', '.log']
    # Exclude known legitimate writes if causing FPs
  condition: selection
level: high

Mitigations

Prioritize immediate patching and implement compensating controls to limit potential impact.

Patch Immediately: Upgrade BeyondTrust Remote Support to a patched version beyond 26.2.3 as soon as possible. Refer to the vendor advisory for specific patch versions.
Network Segmentation: Isolate BeyondTrust Remote Support appliances on a dedicated network segment with strict ingress/egress filtering to limit exposure and contain potential breaches.
Principle of Least Privilege: Ensure that the BeyondTrust appliance and associated services operate with the minimum necessary privileges.
Monitor Appliance Logs: Implement robust logging and continuous monitoring of BeyondTrust appliance system and application logs for suspicious activity.
Web Application Firewall (WAF): Deploy a WAF in front of the BeyondTrust appliance to detect and block suspicious web requests, although this vulnerability may bypass some WAF rules due to its internal component nature.

References

https://www.beyondtrust.com/blog/entry/bt26-05
https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066
https://nvd.nist.gov/vuln/detail/CVE-2026-102764
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764
https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
https://ltna.com.au/cyber
https://socprime.com/blog/cve-2026-10264-beyondtrust-zero-day-exploited/
https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/e3a50834-c553-4e4c-b521-58d936951de5/Chinese-Hackers-Exploit-BeyondTrust-Zero-Day-to-Gain-Root-Access-and-Deploy-Backdoors.pdf

Indicators of Compromise

Type	Value	Description
SHA256	`1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462`	SHA-256 hash of the BARECLAW binary (via https://socprime.com/blog/cve-2026-102764-beyondtrust-zero-day-exploited/)
SHA256	`dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb`	SHA-256 hash of the SAWFLY webshell (via https://socprime.com/blog/cve-2026-102764-beyondtrust-zero-day-exploited/)
info	`ARMORY CASTLE`	Threat actor group observed exploiting CVE-2026-102764.
info	`BARECLAW`	Associated malware family observed in post-exploitation activities.
info	`SAWFLY`	Associated malware family observed in post-exploitation activities.
info	`backdoor`	Generic term for persistent access mechanisms deployed post-exploitation.
info	`webshell`	Common post-exploitation artifact deployed after successful exploitation.

MITRE ATT&CK

T1190 — Exploit Public-Facing Application
T1068 — Exploitation for Privilege Escalation
T1505.003 — Web Shell
T1083 — File and Directory Discovery
T1003 — OS Credential Dumping
T1133 — External Remote Services
T1548.003 — Sudo and Sudo Caching
T1021.004 — SSH
T1005 — Data from Local System
T1572 — Protocol Tunneling
T1136.001 — Local Account
T1070.001 — Clear Windows Event Logs
T1548.001 — Setuid and Setgid
T1552.001 — Credentials In Files
T1041 — Exfiltration Over C2 Channel
T1090.003 — Multi-hop Proxy
T1562.001 — Disable or Modify Tools
T1070.004 — File Deletion
T1543.002 — Systemd Service
T1090.001 — Internal Proxy
T1078.003 — Local Accounts

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  2,394 input / 2,344 output tokens ·

  Reviewed and approved by a human analyst before publication

Tag: privilege escalation

CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass