---
title: "BeyondTrust Remote Support CVE-2026-102764 Zero-Day"
url: https://erroneo.us/security/briefs/beyondtrust-remote-support-cve-2026-102764-zero-day/
description: "China-linked spies exploited an unauthenticated BeyondTrust Remote Support flaw since August. Self-hosted 26.2.3 and older need BT26-05-RS now, then a hunt."
type: security-brief
section: "Security Digest"
date_published: 2026-10-15
date_modified: 2026-10-16
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-102764"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# BeyondTrust Remote Support CVE-2026-102764 Zero-Day

**Verdict: Act now.** If you run a self-hosted BeyondTrust Remote Support appliance, patch it today and assume it may already be compromised; an espionage group used this as a zero-day for about seven weeks.

- **Who must act:** Organizations running self-hosted BeyondTrust Remote Support (any version through 26.2.3), and self-hosted Privileged Remote Access as a precaution.
- **Who can relax:** Teams that do not use BeyondTrust; SaaS customers need no patch (BeyondTrust patched them by October 9) but should still review admin changes and stored credentials.
- **Affected:** BeyondTrust Remote Support (self-hosted) 26.2.3 and earlier; BeyondTrust Remote Support SaaS before the October 2026 vendor patch; BeyondTrust Privileged Remote Access shares the affected code (no exploit path identified by the vendor)
- **Fixed:** Remote Support 24.3.1 through 26.2.3 with the BT26-05-RS patch; Remote Support older than 24.3.1: upgrade to 24.3.1 or later, then apply BT26-05-RS; Remote Support SaaS and Privileged Remote Access SaaS: patched by BeyondTrust by October 9, 2026; Privileged Remote Access (self-hosted): precautionary patch released; confirm the package with BeyondTrust Support
- **CVEs:** CVE-2026-102764
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every Remote Support and Privileged Remote Access deployment, whether it is SaaS or self-hosted, and its version.
2. Apply BT26-05-RS to self-hosted Remote Support today (upgrade to 24.3.1 or later first if older), and confirm it in the /appliance interface.
3. Preserve logs and a snapshot before patching or rebooting any appliance that was internet-reachable while unpatched.
4. Hunt for the published indicators; rebuild from a clean, patched image if compromise is confirmed or cannot be ruled out.
5. After patching or rebuilding, rotate every credential stored in or brokered by the appliance, and review admin, Jump Item and Team permission changes.
6. Apply the precautionary patch to self-hosted Privileged Remote Access.
7. Forward appliance syslog to an external SIEM and alert on permission changes and forwarding gaps.

### How to check if you are affected

- Search the appliance for mangoapi.php (SAWFLY, SHA-256 dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb) and ingredi_ws (BARECLAW, SHA-256 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462).
- Check for /usr/bin/dbus-authd, /home/bomgar/sbin/post_boot.d/zz-root-persist, a NOPASSWD line in /ns/config/sudoers.template, and a /uidchanarge route to 127.0.0.1:19800 in /ns/config/haproxy.conf.
- Review logs for POST requests to unknown .php paths, unexpected WebSocket upgrades, and admin sessions from residential broadband or commercial VPN addresses.
- Look for Jump Item or Team permissions raised from No Access to Administrator, and for syslog gaps bounded by a single session.

## What happened

On October 15, 2026, BeyondTrust disclosed [CVE-2026-102764](https://www.cve.org/CVERecord?id=CVE-2026-102764) (advisory [BT26-05](https://www.beyondtrust.com/trust-center/security-advisories/bt26-05)) in Remote Support, the help-desk remote access product formerly called Bomgar. According to the vendor's CVE record, internal messaging components "did not adequately validate the origin of the messages" they received, which could let an attacker "perform file operations on the appliance". No login or user interaction is needed. Google's threat intelligence team says exploitation "results in the arbitrary upload of files." BeyondTrust scores it CVSS 4.0 9.3, and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-102764) scores it CVSS 3.1 9.8. CISA added it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764) on October 16 with an October 19 deadline and rated it automatable.

This was a zero-day. [Rapid7](https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild), summarizing BeyondTrust, reports two known compromises starting August 29, one on a BeyondTrust-hosted instance and one on a self-hosted appliance. [Google Threat Intelligence Group and Mandiant](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust) attribute the activity to ARMORY CASTLE (formerly UNC5221), a suspected PRC-nexus espionage actor. CrowdStrike tracks the same actor as Warp Panda, per [BleepingComputer](https://bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august). After getting in, the attackers did the following:

- dropped the SAWFLY PHP web shell
- copied `/bin/sh` to a root-owned SUID binary
- dumped the appliance's credential vault with BeyondTrust's own `bt-secrets` tool
- persisted through the sudoers template
- exposed a SOCKS5-over-WebSocket tunneler, BARECLAW, through a modified HAProxy route
- deleted logs
- raised Jump Item and Team permissions to Administrator, then used support sessions to pull files from user desktops

## Who is affected

Every Remote Support version through 26.2.3 is affected. Self-hosted appliances on 24.3.1 through 26.2.3 need the BT26-05-RS patch. Older appliances must first be upgraded to 24.3.1 or later. BeyondTrust says it patched all Remote Support SaaS customers by October 9 (BleepingComputer reports October 8). Privileged Remote Access (PRA) shares the affected code. BeyondTrust has not found a way to exploit it there, but released a PRA patch as a precaution and recommends self-hosted PRA customers apply it now. PRA SaaS was also patched. BleepingComputer cites Shadowserver tracking over 1,400 internet-exposed Remote Support instances.

## Do you really need to act?

If you run self-hosted Remote Support, yes, today, and patching is only half the job. These appliances face the internet by design. They hold credentials for the machines your help desk supports and can open sessions into them, so a compromised appliance is a route into the whole fleet. The attacker had roughly seven weeks before disclosure, and Mandiant found logs deleted throughout the intrusion. Rapid7 stresses that patching does not remove persistence. This is also the second Remote Support flaw in KEV this year, after CVE-2026-1731 in February.

- **Self-hosted Remote Support:** patch now, then investigate as if compromised.
- **Self-hosted PRA:** apply the precautionary patch this week.
- **SaaS customers:** nothing to patch, but one known victim was a hosted instance. Review admin and permission changes and rotate vault credentials.
- **No BeyondTrust:** no exposure.

## What to do now

1. List every Remote Support and PRA deployment, whether it is SaaS or self-hosted, and its version. Check the version in the `/appliance` admin interface.
2. Before touching an appliance that was reachable while unpatched, export logs and take a snapshot. Isolate it if anything looks wrong.
3. Apply BT26-05-RS (upgrade first if you are below 24.3.1), and confirm it in `/appliance`. Patch manually if automatic updates are off, as the [Canadian Cyber Centre](https://cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764) also advises.
4. If compromise is confirmed or cannot be ruled out, rebuild from a clean, fully patched image.
5. Only after patching or rebuilding, rotate every credential stored in or brokered by the appliance, including Vault and integrated Password Safe or PRA credentials. Review admin accounts and downstream support sessions.
6. Forward appliance syslog to an external SIEM over TLS. Turning forwarding on now cannot recover evidence that was already deleted.

## How to tell if you were hit

Google published file indicators: `mangoapi.php` (SAWFLY, SHA-256 `dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb`) and `ingredi_ws` (BARECLAW, `1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462`). Other artifacts include `/usr/bin/dbus-authd`, `/home/bomgar/sbin/post_boot.d/zz-root-persist`, a `NOPASSWD: ALL` line in `/ns/config/sudoers.template`, a `/uidchanarge` route to `127.0.0.1:19800` in `/ns/config/haproxy.conf`, and staging POSTs to an `app_84304470%2Ephp` path. In logs, look for `user_changed` events raising Jump Item or Team roles, admin sessions from residential or commercial VPN addresses, and gaps in syslog forwarding bounded by a single session. BeyondTrust warns that finding no known indicators does not prove an appliance is clean.

## Timeline

- Aug 29, 2026 — First known exploitation, against one hosted and one self-hosted instance.
- Sep 28, 2026 — BeyondTrust discovers and contains the hosted compromise.
- Sep 30, 2026 — Mandiant shares findings from the self-hosted investigation.
- Oct 9, 2026 — BeyondTrust says all Remote Support and PRA SaaS customers are patched.
- Oct 15, 2026 — BT26-05 and the CVE are published, along with Google's ARMORY CASTLE report.
- Oct 16, 2026 — CISA adds the CVE to KEV. The Canadian Cyber Centre issues AL26-025.
- Oct 19, 2026 — CISA's federal deadline. Rapid7 publishes its analysis.

## Sources

1. [BeyondTrust — BT26-05 security advisory](https://www.beyondtrust.com/trust-center/security-advisories/bt26-05)
2. [CVE record — CVE-2026-102764](https://www.cve.org/CVERecord?id=CVE-2026-102764)
3. [NVD — CVE-2026-102764](https://nvd.nist.gov/vuln/detail/CVE-2026-102764)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-102764](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764)
5. [Google Threat Intelligence Group / Mandiant — ARMORY CASTLE Exploits BeyondTrust](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust)
6. [Rapid7 — CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild](https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild)
7. [Canadian Centre for Cyber Security — AL26-025: Critical vulnerability impacting BeyondTrust Remote Support](https://cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764)
8. [BleepingComputer — BeyondTrust patches zero-day exploited in attacks since August](https://bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august)

---
Source page: https://erroneo.us/security/briefs/beyondtrust-remote-support-cve-2026-102764-zero-day/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt