Critical Vulnerability in BeyondTrust Remote Support Under Active Exploitation (CVE-2026-102764)

Executive Summary

On October 15th, 2026, BeyondTrust disclosed a critical vulnerability in its Remote Support product that had already been exploited as a zero-day. Tracked as CVE-2026-102764, the flaw stems from internal appliance components that fail to verify where the messages they receive originate. An unauthenticated, remote attacker can abuse this to perform arbitrary file operations on the appliance, which in observed attacks led to full root control of the host.

BeyondTrust Remote Support (formerly Bomgar) is an enterprise remote access platform that IT teams use to connect to and troubleshoot endpoints across their environment. Because the appliance stores and brokers credentials for the systems it manages, a compromise reaches well beyond the appliance itself. Mandiant attributes the exploitation to ARMORY CASTLE (formerly tracked as UNC5221), a suspected PRC-nexus espionage actor that previously exploited zero-days in Citrix NetScaler and Ivanti Connect Secure and then moved to broad, opportunistic exploitation once those flaws became public.

BeyondTrust and Mandiant have confirmed exploitation in the wild since August 29th, 2026, and both warn that widespread exploitation may follow disclosure. Given the privileged access these appliances hold and this actor's history of mass exploitation after disclosure, Beazley Security recommends affected organizations apply available fixes immediately and conduct a thorough review for any signs of compromise.

Affected Systems or Products

BeyondTrust Privileged Remote Access shares the affected code. BeyondTrust's internal testing found no exploitable path in that product, but the vendor released a patch for it as a precaution.

Mitigations / Workarounds

Patching closes the vulnerability but does not remove a compromise that occurred before the patch was applied. Mandiant advises treating any appliance that was reachable from the internet on a vulnerable version during the exploitation window as potentially compromised until it has been reviewed.

1. 1.

   Apply the BT26-05 patch. Self-hosted appliances on version 24.3.1 or later can install patch BT26-05-RS from the /appliance interface, or confirm it was applied automatically if the appliance is subscribed to automatic updates. Appliances older than 24.3.1 must first be upgraded to a supported release.

2. 2.

   Restrict access to the /login and /appliance administrative interfaces to trusted and administrative networks. Only the representative console, customer portal, and Jump Client traffic should be reachable from the internet.

3. 3.

   Limit outbound traffic from the appliance to BeyondTrust update and licensing endpoints and the organization's own syslog and directory servers.

4. 4.

   If compromise is confirmed or cannot be ruled out, preserve a memory and disk snapshot, block inbound traffic to the appliance at the perimeter firewall, and rebuild from a clean, fully patched image. Rebooting or resetting the appliance does not remove the persistence observed in these attacks.

5. 5.

   After the appliance is patched or rebuilt, rotate every credential it stored or brokered: /appliance and /login administrator accounts, API client secrets, security provider bind accounts and SAML signing keys, Remote Support Vault and Password Safe credentials, integration credentials, and any credential entered during a support session in the exposure window. Rotating before patching hands the new credentials to an attacker who still controls the device.

6. 6.

   Review new MFA registrations on privileged accounts and reset any default Jump Item role in group policies to "No Access."

BeyondTrust asks customers who find evidence of exploitation to open a Severity 1 support request referencing "BT26-05." Customers can also request a threat hunting package through the BeyondTrust trust portal.

Patches

BeyondTrust has automatically patched all Remote Support and Privileged Remote Access SaaS instances, and no action is required on the appliance itself for cloud customers.

Fixes are available for self-hosted Remote Support and Privileged Remote Access, and additional information can be found in the official BeyondTrust BT26-05 advisory.

Indicators of Compromise

BeyondTrust confirmed that ARMORY CASTLE exploited this vulnerability against one BeyondTrust-hosted instance and one self-hosted appliance beginning August 29th, 2026. A public proof of concept has not been released as of publication of this advisory.

After exploitation, the actor staged a PHP web shell in the appliance's Laravel web root, escalated to root through a copy of the system shell with the SUID bit set, and added a startup script under /home/bomgar/sbin/post_boot.d that grants the site service account passwordless sudo access. The actor also attempted to dump the appliance's credential vault with the native bt-secrets utility and modified the appliance's HAProxy configuration to expose a SOCKS5 tunneler to the internet. Customers cannot audit the appliance host file system directly, so focus hunting on the logs and configuration available to administrators:

• 

  Appliance syslog "user_changed" events that raise a Jump Item or Team role, particularly from "No Access" to "Administrator."

• 

  Successful /login administrator sessions from residential broadband or commercial VPN address space, or outside business hours.

• 

  Unknown .php request paths and unexpected WebSocket upgrades in reverse proxy, WAF, or perimeter firewall logs for the appliance.

• 

  Gaps in syslog forwarding from the appliance, particularly an interruption that begins and ends within a single session, which indicates log tampering.

• 

  Support session reports showing file transfers or sessions launched by accounts whose roles changed during the exposure window.

The actor deleted system, web server, and application logs throughout the intrusion, so logs held off the appliance carry the most weight.

Mandiant and Google Threat Intelligence Group (GTIG) published the following indicators from their incident response investigation. Mandiant could not recover the staging file, so it has no hash and its filename should not be treated as a confirmed malware sample.

Mandiant also documented the following host and network artifacts:

Mandiant has also published YARA rules for SAWFLY and BARECLAW, and makes the full indicator set available to registered users through a Google Threat Intelligence collection.

Technical Details

CVE-2026-102764 is an origin validation failure in internal messaging components of the Remote Support appliance. The components accept messages without confirming they came from a trusted source, and an unauthenticated, remote attacker can use this to perform file operations on the appliance. Mandiant observed this result in arbitrary file upload. BeyondTrust has withheld further technical detail, and the vendor's variant analysis found additional paths to the same weakness, which the patch also closes.

The post-exploitation activity shows a detailed understanding of the appliance internals. Mandiant and GTIG researchers Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, and John Wolfram found that ARMORY CASTLE abused BeyondTrust's own command-line utilities and configuration templates so that its root access survived reboots and configuration resets. With stolen administrator credentials, the actor then opened support sessions to downstream endpoints and used the product's built-in file transfer feature to collect internal IT documents.

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• 

  https://nvd.nist.gov/vuln/detail/CVE-2026-102764

• 

  https://www.beyondtrust.com/blog/entry/bt26-05

• 

  https://github.com/advisories/GHSA-pf95-v8m2-73q8

• 

  https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/