BeyondTrust Remote Support CVE-2026-102764 Exploited

BeyondTrust Remote Support self-hosted appliances up to version 26.2.3 carry CVE-2026-102764, a CVSS 4.0 9.3 flaw that lets an unauthenticated attacker perform file operations on the appliance. Mandiant says the China-nexus group ARMORY CASTLE exploited it as a zero-day from late August 2026. BeyondTrust disclosed it on 15 October, and CISA added it to KEV on 16 October with a 19 October deadline. Apply patch BT26-05-RS now, then treat any exposed appliance as possibly compromised.

What happened

BeyondTrust published advisory BT26-05 on 15 October 2026. The CVE record, filed by BeyondTrust as the CNA, describes the bug as improper origin validation in internal messaging components of Remote Support: the components did not check where the messages they received came from. Under the right conditions, an attacker can perform file operations on the appliance without logging in. The weakness is classed as CWE-290, authentication bypass by spoofing.

Google Threat Intelligence Group (GTIG) and Mandiant published their investigation the same day. They attribute the intrusion to ARMORY CASTLE, the cluster previously tracked as UNC5221, which they assess as a suspected PRC-nexus espionage actor active since at least October 2023. According to Beazley Security's summary of the disclosure, exploitation began on 29 August 2026 and hit two appliances: one BeyondTrust-hosted Remote Support instance and one self-hosted appliance.

BeyondTrust says its variant analysis found additional paths to the same weakness, and the patch closes those too. No public proof of concept existed when Beazley Security published its advisory, and technical detail has been withheld.

CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities catalog on 16 October 2026 with a due date of 19 October, and flagged it for forensic triage under BOD 26-04. That flag matters: CISA expects agencies to look for compromise, not only to patch.

Who is affected by the BeyondTrust Remote Support flaw

Self-hosted Remote Support (formerly Bomgar) appliances, all supported versions up to and including 26.2.3. One secondary write-up describes the range as versions before 26.2.3; the CVE record and GTIG both say 26.2.3 and earlier are affected, so treat 26.2.3 as vulnerable.
Remote Support SaaS: GTIG says BeyondTrust patched every SaaS tenant on 9 October 2026. Some reporting gives 8 October. No appliance action is needed, but the credential and configuration steps below still apply.
Privileged Remote Access (PRA): it shares the affected code. BeyondTrust's testing found no exploitable path, but it released a precautionary patch and recommends applying it.

If you run Remote Support as an MSP or internal help desk, the appliance holds administrative credentials, Jump Client tokens and vaulted passwords for the endpoints it supports. That is the real exposure, and it is the same reason the ScreenConnect CVE-2026-84869 attacks spread so far. Our explainer on what a remote support appliance can reach in your network covers what sits inside one.

Technical analysis: what the attackers did after getting in

GTIG reconstructed the intrusion in detail. At a high level:

The file-operation flaw let the attacker place a staging file, then a PHP web shell (SAWFLY) in the appliance's Laravel web root, running as the site service account.
The attacker escalated to root by abusing a SUID copy of the system shell.
A startup script in post_boot.d edited BeyondTrust configuration templates to give the service account passwordless sudo. GTIG says this persistence survived reboots and configuration resets.
The attacker tried to dump the credential vault with the appliance's own bt-secrets utility, including site-level and global administrator credentials.
HAProxy configuration was changed to route a WebSocket path to BARECLAW, a SOCKS5-over-WebSocket tunneler that listened only on localhost so external scans would miss it.
System, web server, PHP, auth and secrets-tool logs were deleted throughout.

The hands-on-keyboard phase used the product as designed. With a stolen Administrator account, the actor raised a local account's Jump Item and Team roles from "No Access" to "Administrator", opened support sessions to downstream endpoints and used the built-in file transfer feature to collect internal IT documents such as software inventories.

GTIG assesses with high confidence that ARMORY CASTLE will keep using edge-device zero-days, and that broad opportunistic exploitation is likely now that the bug is public. The group's earlier zero-days in Citrix NetScaler and Ivanti Connect Secure followed that pattern.

What to do now

Patch. On self-hosted appliances running 24.3.1 or later, apply BT26-05-RS from the /appliance interface or confirm that automatic updates installed it. Appliances older than 24.3.1 must first upgrade to a supported release, then apply the patch. If the patch does not appear in /appliance, open a case with BeyondTrust Support referencing BT26-05. Apply the PRA patch as well.

Assume exposure until reviewed. GTIG's guidance is that any appliance reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised. Patching closes the hole; it does not remove a web shell or a root startup script.

Hunt off the appliance. Customers cannot audit the appliance file system, and the actor deleted local logs, so forwarded syslog, reverse proxy, WAF and firewall logs carry the weight. Look for:

user_changed events that raise a Jump Item or Team role, especially "No Access" to "Administrator"
user_added, api_account and security_provider events with no change ticket
/login administrator successes from residential broadband or commercial VPN address space, or outside business hours
requests to unknown .php paths and unexpected WebSocket upgrades at the proxy or WAF, including the path /uidchanarge
gaps in syslog forwarding that start and end inside one session
support session reports showing file transfers by accounts whose roles changed

Our guide on how to audit remote support logs for role escalation walks through that review step by step.

Indicators published by GTIG include mangoapi.php (SAWFLY, SHA-256 dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb), ingredi_ws (BARECLAW, SHA-256 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462), a root-owned SUID shell at /usr/bin/dbus-authd, the persistence script /home/bomgar/sbin/post_boot.d/zz-root-persist, a local listener on 127.0.0.1:19800 and HAProxy ACL wswsws with backend webskd3. GTIG also published YARA rules G_Hunting_Webshell_SAWFLY_1 and G_Hunting_Backdoor_BARECLAW_1. If you find evidence, BeyondTrust asks for a Severity 1 support request referencing BT26-05.

If compromise is confirmed or cannot be ruled out, rebuild. Snapshot virtual appliances with memory first (for B Series hardware and SaaS, request preservation through BeyondTrust Support), block inbound traffic at the perimeter rather than in /appliance, restrict egress to BeyondTrust update and licensing endpoints, and disable rather than delete sessions, Jump Clients, Jumpoints and API accounts. Then rebuild from a clean, fully patched image, restore only a configuration backup dated before the exposure window, issue a new TLS certificate and redeploy Jump Clients, Jumpoints and the representative console. A reboot or reset does not remove the persistence. We covered why in why a clean integrity check cannot clear a compromised appliance.

Rotate credentials after, not before. GTIG warns that rotating before the appliance is patched or rebuilt hands the new secrets to an attacker who still controls it. Its order: /appliance admins, /login admins and local users, API client secrets, security provider bind accounts and SAML signing keys, Remote Support Vault and integrated Password Safe or PRA credentials (rotated at the target system), integration credentials such as SMTP, syslog and ITSM connectors, and finally anything typed into a support session during the window. The reasoning is in why you rotate credentials only after the rebuild.

Harden. Restrict /login and /appliance to administrative networks so only the representative console, customer portal and Jump Client traffic face the internet. Require SAML SSO with phishing-resistant MFA, cut local accounts down to one vaulted break-glass account, set the default Jump Item role in every group policy to "No Access", and review new MFA registrations on privileged accounts.

What to watch next

Expect scanning to rise now that the advisory and indicators are public; GTIG predicts opportunistic exploitation. Watch for a public proof of concept, additional victims named by BeyondTrust or CISA, and any update to the PRA assessment. If your appliance sat on the internet unpatched between 29 August and the day you applied BT26-05-RS, schedule the hunt now rather than waiting for a second advisory.