CVE-2026-102764: 
BeyondTrust Remote Support Client Analyse et atténuation des vulnérabilités

CVE-2026-102764 is a critical authentication bypass by spoofing vulnerability in BeyondTrust's Remote Support product. Internal components of the appliance fail to adequately validate the origin of messages they receive, allowing an unauthenticated attacker to perform unauthorized file operations on the appliance. All versions up to and including 26.2.3 are affected. The vulnerability was published on October 15, 2026, with a patch released the same day. It carries a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, ENISA/EUVD).

The root cause is classified as CWE-290 (Authentication Bypass by Spoofing): internal messaging components within the BeyondTrust Remote Support appliance do not properly verify the origin of incoming messages, enabling an attacker to spoof trusted internal sources. The attack vector is network-based, requires no privileges, no user interaction, and no special attack requirements, making it trivially exploitable by any unauthenticated remote attacker who can reach the appliance. By sending specially crafted messages that impersonate trusted internal components, an attacker can trigger unauthorized file operations on the appliance. No public proof-of-concept code has been confirmed, but active exploitation has been observed in the wild since at least August 2026 (GitHub Advisory, Google Cloud Blog).

Successful exploitation allows an unauthenticated remote attacker to perform arbitrary file operations on the BeyondTrust Remote Support appliance, with high impact to confidentiality, integrity, and availability of the vulnerable system. Threat actors have been reported to leverage this vulnerability to steal credentials, maintain persistent root-level access, and deploy backdoors on compromised appliances. Given that BeyondTrust Remote Support is a privileged access management tool used in enterprise environments, compromise of the appliance can serve as a launchpad for lateral movement and broader network intrusion (Google Cloud Blog, BleepingComputer, UnderCodeNews).

This vulnerability has been actively exploited in the wild since at least August 2026, approximately two months before public disclosure and patching (BleepingComputer). Threat actor UTA0178 (also tracked as WARP PANDA, a suspected Chinese espionage group) has been attributed to exploitation of this zero-day, with activity documented by Google Mandiant under the campaign name "ARMORY CASTLE" (Google Cloud Blog, Threadlinqs Intelligence). No public proof-of-concept exploit code has been confirmed. The EPSS score is currently 0.0 (likely not yet updated to reflect active exploitation), and CISA KEV catalog status is not confirmed in available sources.

1. Reconnaissance: Identify internet-facing BeyondTrust Remote Support appliances running version 26.2.3 or earlier using tools such as Shodan or Censys, targeting known BeyondTrust service ports and web interfaces.
2. Craft spoofed internal message: Construct a specially crafted message that mimics the format expected by internal BeyondTrust Remote Support components, exploiting the lack of origin validation (CWE-290) to impersonate a trusted internal source.
3. Send malicious message to appliance: Transmit the crafted message to the appliance over the network without requiring authentication, credentials, or user interaction.
4. Trigger unauthorized file operations: The appliance processes the spoofed message as if it originated from a trusted internal component, allowing the attacker to read, write, or manipulate files on the appliance filesystem.
5. Establish persistence: Leverage file write capabilities to deploy backdoors, modify configuration files, or plant web shells to maintain persistent root-level access to the appliance.
6. Credential theft and lateral movement: Access stored credentials or session tokens within the appliance to pivot into connected enterprise systems managed via BeyondTrust Remote Support (Google Cloud Blog, BleepingComputer).

• Network: Unexpected or anomalous inbound connections to BeyondTrust Remote Support appliance internal service ports from external or untrusted IP addresses; outbound connections from the appliance to unknown external IPs, particularly those associated with UTA0178/WARP PANDA infrastructure.
• File System: Unauthorized or unexpected new files on the appliance filesystem, particularly in web-accessible directories or configuration paths; modified configuration files or newly created scripts/executables; presence of backdoor files or web shells.
• Logs: Appliance logs showing message processing activity from unrecognized or external origins; authentication events or file operation logs triggered without corresponding legitimate user sessions; log gaps or evidence of log tampering.
• Process: Unusual processes spawned on the appliance, particularly those with elevated (root) privileges not associated with normal BeyondTrust operations; unexpected outbound network connections initiated by appliance service processes.
• Credentials: Evidence of credential harvesting from the appliance, such as access to stored session tokens or credential vaults; use of harvested credentials from downstream systems connected via BeyondTrust Remote Support (Google Cloud Blog, UnderCodeNews).

BeyondTrust released a patch on October 15, 2026; organizations should immediately upgrade BeyondTrust Remote Support to version 26.2.4 or later (GitHub Advisory, BeyondTrust Advisory). As a network-level workaround, restrict access to Remote Support appliances to trusted internal networks only, blocking exposure to untrusted or internet-facing traffic. Additionally, monitor appliance file systems for unauthorized modifications and review access logs for suspicious internal component message activity. Organizations should also audit credentials and sessions managed through the appliance for signs of compromise given the active exploitation since August 2026 (BeyondTrust KB).

BeyondTrust published an advisory and knowledge base article on October 15, 2026, the same day the vulnerability was disclosed and patched (BeyondTrust Advisory). Google Mandiant published a threat intelligence report attributing exploitation to the suspected Chinese espionage group ARMORY CASTLE (UTA0178/WARP PANDA), noting attacks dating back to August 2026 (Google Cloud Blog). Security researchers from watchTowr commented on the vulnerability via Mastodon, and the story received broad coverage from BleepingComputer, The Hacker News, CyberSecurityNews, and CyberPress, with significant social media discussion on LinkedIn, Bluesky, and Mastodon highlighting the severity and nation-state attribution (BleepingComputer, The Hacker News, watchTowr).