erroneo.us
Search all guides⌘K

Security Digest · Oct 15, 2026 · Vulnerability · Network edge

BeyondTrust Remote Support CVE-2026-102764 Zero-Day

China-linked spies exploited an unauthenticated BeyondTrust Remote Support flaw since August. Self-hosted 26.2.3 and older need BT26-05-RS now, then a hunt.

Published By erroneo.us Security Desk · Updated 4 min read8 sources

Our verdict

Act now

If you run a self-hosted BeyondTrust Remote Support appliance, patch it today and assume it may already be compromised; an espionage group used this as a zero-day for about seven weeks.

Who must act: Organizations running self-hosted BeyondTrust Remote Support (any version through 26.2.3), and self-hosted Privileged Remote Access as a precaution.

Who can relax: Teams that do not use BeyondTrust; SaaS customers need no patch (BeyondTrust patched them by October 9) but should still review admin changes and stored credentials.

Affected
BeyondTrust Remote Support (self-hosted) 26.2.3 and earlier
BeyondTrust Remote Support SaaS before the October 2026 vendor patch
BeyondTrust Privileged Remote Access shares the affected code (no exploit path identified by the vendor)
Fixed in
Remote Support 24.3.1 through 26.2.3 with the BT26-05-RS patch
Remote Support older than 24.3.1: upgrade to 24.3.1 or later, then apply BT26-05-RS
Remote Support SaaS and Privileged Remote Access SaaS: patched by BeyondTrust by October 9, 2026
Privileged Remote Access (self-hosted): precautionary patch released; confirm the package with BeyondTrust Support
CVSS
9.3 (v4.0, vendor)
EPSS
1.2% (percentile 67)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Inventory every Remote Support and Privileged Remote Access deployment, whether it is SaaS or self-hosted, and its version.
  2. Apply BT26-05-RS to self-hosted Remote Support today (upgrade to 24.3.1 or later first if older), and confirm it in the /appliance interface.
  3. Preserve logs and a snapshot before patching or rebooting any appliance that was internet-reachable while unpatched.
  4. Hunt for the published indicators; rebuild from a clean, patched image if compromise is confirmed or cannot be ruled out.
  5. After patching or rebuilding, rotate every credential stored in or brokered by the appliance, and review admin, Jump Item and Team permission changes.
  6. Apply the precautionary patch to self-hosted Privileged Remote Access.
  7. Forward appliance syslog to an external SIEM and alert on permission changes and forwarding gaps.

How to check if you are affected or compromised

  • Search the appliance for mangoapi.php (SAWFLY, SHA-256 dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb) and ingredi_ws (BARECLAW, SHA-256 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462).
  • Check for /usr/bin/dbus-authd, /home/bomgar/sbin/post_boot.d/zz-root-persist, a NOPASSWD line in /ns/config/sudoers.template, and a /uidchanarge route to 127.0.0.1:19800 in /ns/config/haproxy.conf.
  • Review logs for POST requests to unknown .php paths, unexpected WebSocket upgrades, and admin sessions from residential broadband or commercial VPN addresses.
  • Look for Jump Item or Team permissions raised from No Access to Administrator, and for syslog gaps bounded by a single session.

What happened#

On October 15, 2026, BeyondTrust disclosed CVE-2026-102764 (advisory BT26-05) in Remote Support, the help-desk remote access product formerly called Bomgar. According to the vendor's CVE record, internal messaging components "did not adequately validate the origin of the messages" they received, which could let an attacker "perform file operations on the appliance". No login or user interaction is needed. Google's threat intelligence team says exploitation "results in the arbitrary upload of files." BeyondTrust scores it CVSS 4.0 9.3, and NVD scores it CVSS 3.1 9.8. CISA added it to KEV on October 16 with an October 19 deadline and rated it automatable.

This was a zero-day. Rapid7, summarizing BeyondTrust, reports two known compromises starting August 29, one on a BeyondTrust-hosted instance and one on a self-hosted appliance. Google Threat Intelligence Group and Mandiant attribute the activity to ARMORY CASTLE (formerly UNC5221), a suspected PRC-nexus espionage actor. CrowdStrike tracks the same actor as Warp Panda, per BleepingComputer. After getting in, the attackers did the following:

  • dropped the SAWFLY PHP web shell
  • copied /bin/sh to a root-owned SUID binary
  • dumped the appliance's credential vault with BeyondTrust's own bt-secrets tool
  • persisted through the sudoers template
  • exposed a SOCKS5-over-WebSocket tunneler, BARECLAW, through a modified HAProxy route
  • deleted logs
  • raised Jump Item and Team permissions to Administrator, then used support sessions to pull files from user desktops

Who is affected#

Every Remote Support version through 26.2.3 is affected. Self-hosted appliances on 24.3.1 through 26.2.3 need the BT26-05-RS patch. Older appliances must first be upgraded to 24.3.1 or later. BeyondTrust says it patched all Remote Support SaaS customers by October 9 (BleepingComputer reports October 8). Privileged Remote Access (PRA) shares the affected code. BeyondTrust has not found a way to exploit it there, but released a PRA patch as a precaution and recommends self-hosted PRA customers apply it now. PRA SaaS was also patched. BleepingComputer cites Shadowserver tracking over 1,400 internet-exposed Remote Support instances.

Do you really need to act?#

If you run self-hosted Remote Support, yes, today, and patching is only half the job. These appliances face the internet by design. They hold credentials for the machines your help desk supports and can open sessions into them, so a compromised appliance is a route into the whole fleet. The attacker had roughly seven weeks before disclosure, and Mandiant found logs deleted throughout the intrusion. Rapid7 stresses that patching does not remove persistence. This is also the second Remote Support flaw in KEV this year, after CVE-2026-1731 in February.

  • Self-hosted Remote Support: patch now, then investigate as if compromised.
  • Self-hosted PRA: apply the precautionary patch this week.
  • SaaS customers: nothing to patch, but one known victim was a hosted instance. Review admin and permission changes and rotate vault credentials.
  • No BeyondTrust: no exposure.

What to do now#

  1. List every Remote Support and PRA deployment, whether it is SaaS or self-hosted, and its version. Check the version in the /appliance admin interface.
  2. Before touching an appliance that was reachable while unpatched, export logs and take a snapshot. Isolate it if anything looks wrong.
  3. Apply BT26-05-RS (upgrade first if you are below 24.3.1), and confirm it in /appliance. Patch manually if automatic updates are off, as the Canadian Cyber Centre also advises.
  4. If compromise is confirmed or cannot be ruled out, rebuild from a clean, fully patched image.
  5. Only after patching or rebuilding, rotate every credential stored in or brokered by the appliance, including Vault and integrated Password Safe or PRA credentials. Review admin accounts and downstream support sessions.
  6. Forward appliance syslog to an external SIEM over TLS. Turning forwarding on now cannot recover evidence that was already deleted.

How to tell if you were hit#

Google published file indicators: mangoapi.php (SAWFLY, SHA-256 dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb) and ingredi_ws (BARECLAW, 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462). Other artifacts include /usr/bin/dbus-authd, /home/bomgar/sbin/post_boot.d/zz-root-persist, a NOPASSWD: ALL line in /ns/config/sudoers.template, a /uidchanarge route to 127.0.0.1:19800 in /ns/config/haproxy.conf, and staging POSTs to an app_84304470%2Ephp path. In logs, look for user_changed events raising Jump Item or Team roles, admin sessions from residential or commercial VPN addresses, and gaps in syslog forwarding bounded by a single session. BeyondTrust warns that finding no known indicators does not prove an appliance is clean.

Timeline#

  • — First known exploitation, against one hosted and one self-hosted instance.
  • — BeyondTrust discovers and contains the hosted compromise.
  • — Mandiant shares findings from the self-hosted investigation.
  • — BeyondTrust says all Remote Support and PRA SaaS customers are patched.
  • — BT26-05 and the CVE are published, along with Google's ARMORY CASTLE report.
  • — CISA adds the CVE to KEV. The Canadian Cyber Centre issues AL26-025.
  • — CISA's federal deadline. Rapid7 publishes its analysis.

Vulnerability records

  • CVE-2026-102764 · KEV 2026-10-16 · The vulnerability exists within internal components of BeyondTrust’s Remote Support product.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. BeyondTrust — BT26-05 security advisory beyondtrust.com
  2. CVE record — CVE-2026-102764 cve.org
  3. NVD — CVE-2026-102764 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2026-102764 cisa.gov
  5. Google Threat Intelligence Group / Mandiant — ARMORY CASTLE Exploits BeyondTrust cloud.google.com
  6. Rapid7 — CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild rapid7.com
  7. Canadian Centre for Cyber Security — AL26-025: Critical vulnerability impacting BeyondTrust Remote Support cyber.gc.ca

Coverage and analysis

  1. BleepingComputer — BeyondTrust patches zero-day exploited in attacks since August bleepingcomputer.com