BeyondTrust disclosed CVE-2026-102764 on October 15, 2026. The vulnerability is a critical improper origin validation flaw (CWE-290) affecting an internal messaging component of BeyondTrust Remote Support (RS, formerly Bomgar). A remote attacker can exploit the issue to perform file operations on a vulnerable appliance.

Google Threat Intelligence Group (GTIG) and Mandiant report that the suspected PRC-linked espionage actor ARMORY CASTLE (formerly UNC5221) exploited the vulnerability as a zero-day in late August 2026 before a patch was available. According to GTIG, the flaw can be exploited by an unauthenticated remote attacker and may result in full host-level control along with access to all credentials stored or brokered by the appliance.

BeyondTrust patched SaaS customers by October 9, 2026. Self-hosted deployments require manual patching.

GTIG warns that broader exploitation attempts are likely following public disclosure. Any internet-exposed appliance running a vulnerable version during the exploitation window should be treated as potentially compromised until investigated.

Affected Systems and Applications

Affected Product

• BeyondTrust Remote Support (RS)

Affected Versions

• All versions up to and including 26.2.3

Deployment Status

Remote Support SaaS

• Patched by BeyondTrust as of October 9, 2026
• No further appliance action specified

Self-Hosted Versions 24.3.1 through 26.2.3

• Vulnerable
• Apply the BT26-05-RS patch

Self-Hosted Versions Older Than 24.3.1

• Vulnerable
• Upgrade to a supported version before applying the patch

The vendor advisory and CVE record identify only Remote Support as affected.

Technical Details

Vulnerability Mechanism

The flaw exists within internal components of BeyondTrust Remote Support that insufficiently validate the origin of messages they receive.

Under certain conditions, an attacker can perform unauthorized file operations on the appliance.

Classification

• CWE-290: Authentication Bypass by Spoofing
• CAPEC-194: Fake the Source of Data

The impact is described as an arbitrary file upload by an unauthenticated remote attacker, enabling:

• Host-level compromise
• Credential theft
• Access to all credentials stored or brokered by the appliance

The CVSS vector reflects:

• Network-based attack
• Low attack complexity
• No authentication required
• No user interaction required
• High confidentiality impact
• High integrity impact
• High availability impact

Observed Exploitation Path

The following attack sequence was observed during incident response activities:

1. Initial Access and Web Shell Deployment

Attackers sent POST requests to:

/app_84304470%2Ephp

followed by deploying the SAWFLY web shell:

mangoapi.php

Location:

/%SITE_SERVICE_ACCOUNT%/ingredi/app/laravel/public/

SAWFLY characteristics:

• Obfuscated PHP web shell
• Encrypted bidirectional command-and-control
• Custom Base32 transport
• RC4 encryption
• Returns HTTP 404 unless parameter _c94mfe is supplied

2. Root Persistence

Attackers copied:

/bin/sh

to:

/usr/bin/dbus-authd

with:

• Root ownership
• SUID permissions

3. Credential Theft

Attackers used:

/ns/sbin/bt-secrets

to collect appliance credentials and subsequently deleted related logs.

4. Persistent Access

Attackers created:

/home/bomgar/sbin/post_boot.d/zz-root-persist

which adds a passwordless sudo entry to:

/ns/config/sudoers.template

5. Log Manipulation

Deleted logs reportedly included:

• /ns/log/auth.log
• /ns/log/ssl.log
• /var/log/messages
• /tmp/sshauth.*

6. Administrative Abuse

Using compromised administrator credentials, attackers:

• Logged into the web administration portal
• Elevated Jump Item permissions
• Elevated Team permissions
• Initiated remote support sessions
• Transferred files from downstream systems
• Exfiltrated sensitive documents

7. Tunneling Infrastructure

Attackers deployed the BARECLAW SOCKS5-over-WebSocket tunneler:

/tmp/ingredi_ws

Characteristics:

• Listens on localhost TCP 19800
• Exposed externally through modified HAProxy configuration
• Uses WebSocket path:

/uidchanarge

The operator reportedly leveraged commercial VPN infrastructure and compromised consumer routers to conceal activity.

Mitigation

Immediate Actions for Self-Hosted Deployments

Limit Exposure

No vendor-provided workaround exists. Patching is required.

GTIG recommendations for potentially compromised or unpatched systems include:

• Block inbound access to the appliance.
• Restrict outbound network communications using default-deny egress filtering.
• Disable (do not delete):
  • Sessions
  • Jump Clients
  • Jumpoints
  • API accounts
• Require SAML-based SSO with phishing-resistant MFA.
• Set the default Jump Item role to No Access.
• Restrict API account permissions.
• Avoid storing privileged credentials in the Remote Support Vault.

Patch and Upgrade

Self-hosted versions 24.3.1 through 26.2.3

• Apply BT26-05-RS.

Self-hosted versions older than 24.3.1

• Upgrade first.
• Then apply BT26-05-RS.

Remote Support SaaS

• Patched by BeyondTrust as of October 9, 2026.

What the Cyber Fusion Center Is Doing

The CFC is monitoring the situation and analyzing the case to identify potential threat-hunting campaigns. This advisory will be updated if required.

References

• BeyondTrust Security Advisory BT26-05: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
• BeyondTrust Blog BT26-05: https://www.beyondtrust.com/blog/entry/bt26-05
• BeyondTrust Knowledge Base KB0024066: https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066
• CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-102764
• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-102764
• Google Threat Intelligence Group / Mandiant: https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
• Cyber Kendra: https://www.cyberkendra.com/2026/10/cve-2026-102764-beyondtrust-zero-day-exploited-in-attacks.html
• CISA KEV Catalog: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-102764

‍