Google Warns of Widespread Exploitation of BeyondTrust Zero-Day

Google and Mandiant have warned organizations to prepare for widespread exploitation of a critical zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support appliances. The flaw, which carries a CVSS rating of 9.3, allows unauthenticated attackers to perform arbitrary file uploads, obtain root-level control, and access credential vaults.

Google and its Threat Intelligence Group reported that a suspected China-linked espionage actor known as Armory Castle began exploiting the vulnerability in late August 2026. The attackers deployed a PHP webshell called Sawfly and a tunneler tool called Bareclaw to establish persistent backdoors. Once inside, Armory Castle used proprietary CLI utilities to harvest credentials from the native secrets database and modified configuration templates to gain unrestricted administrative access to downstream systems.

BeyondTrust detected the intrusions on September 28 and released a patch on October 8, 2026. While SaaS customers were patched automatically by October 9, self-hosted users on versions 26.2.3 and earlier must manually install patch BT26-05-RS. Security experts warn that because patching does not remove existing attacker persistence, any appliance reachable from the internet during the exploitation window should be treated as potentially compromised. Organizations are urged to hunt for signs of compromise and rotate all exposed credentials immediately.