BeyondTrust Remote Support zero-day is being exploited (CVE-2026-102764)

What is happening

CVE-2026-102764 is a critical flaw (CVSS 3.1: 9.8) in BeyondTrust Remote Support, the remote-support appliance formerly called Bomgar. Internal components did not check where the messages they received came from, so an attacker who can reach the appliance over the network, with no account, can make it perform file operations: in practice, upload files to it. Google’s Threat Intelligence Group (GTIG) reports that a suspected China-nexus espionage actor it tracks as ARMORY CASTLE (formerly UNC5221) used the flaw as a zero-day from late August 2026 to take root on an appliance, dump every credential it stored and open sessions into the systems it managed.

A patch exists: BT26-05-RS, for self-hosted versions 24.3.1 to 26.2.3; older versions must upgrade first. BeyondTrust patched all SaaS tenants on 9 October 2026. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 16 October and gave US federal civilian agencies until 19 October 2026.

Patching closes the door; it does not evict anyone already inside. GTIG’s advice is blunt: any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed.

Who is affected

Every organisation running BeyondTrust Remote Support (formerly Bomgar) self-hosted at version 26.2.3 or earlier: that is all supported versions, according to CISA and GTIG. Appliances whose web interface is reachable from the internet are the most exposed, because the flaw needs no credentials.

SaaS customers: BeyondTrust applied the patch to all Remote Support SaaS tenants on 9 October 2026, so there is nothing to install. The hunting advice below still applies to the accounts, roles and sessions you control.

Keep in mind what this appliance holds. Remote Support brokers access to endpoints and stores credentials for them; GTIG describes the impact as access to every credential the appliance stores or brokers, and the actor used stolen administrator credentials to start sessions into internal systems. The blast radius is not the appliance. It is everything the appliance can reach.

Do this now

1. Patch today. Self-hosted appliances on 24.3.1 to 26.2.3: apply BT26-05-RS from the /appliance interface, as described in BeyondTrust advisory BT26-05. Older than 24.3.1: upgrade to a supported version first, then apply the patch. SaaS tenants were patched by BeyondTrust on 9 October 2026.
2. Preserve before you touch anything. If the appliance was reachable from the internet on a vulnerable version at any time since late August 2026, treat it as potentially compromised. Snapshot the virtual appliance with its memory (or image a physical one) and collect the logs that live off the box: reverse proxy, WAF, perimeter firewall, your SIEM. The actor deleted the appliance’s own logs throughout the intrusion.
3. Hunt with the indicators below. The fastest checks: a root-owned SUID copy of /bin/sh at /usr/bin/dbus-authd; the boot script /home/bomgar/sbin/post_boot.d/zz-root-persist; a webskd3 backend or /uidchanarge path in /ns/config/haproxy.conf; /tmp/ingredi_ws; unknown .php files under the site’s Laravel public directory; and user_changed events in /login that raised an account’s Jump Item or Team roles.
4. If you find any of it, rebuild, do not clean. Isolate the appliance, redeploy it from a clean image, apply the patch, then rotate every credential the appliance stored or injected, in dependency order, revoke all active support sessions and review new MFA registrations on privileged accounts. Rotate after the rebuild, not before: new secrets handed to a compromised appliance are stolen too.
5. Cut the exposure. Restrict /login and /appliance to trusted networks or a VPN, require SAML single sign-on with phishing-resistant MFA for administrators, and forward syslog and session events to your SIEM so the next log deletion leaves a visible gap. US federal civilian agencies must remediate by 19 October 2026 (CISA BOD 22-01); everyone else should treat that date as the benchmark.

Vulnerability details

NVD describes the weakness as follows: “The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.” It is classified as CWE-290, Authentication Bypass by Spoofing. GTIG puts the result more plainly: arbitrary file upload by an unauthenticated remote attacker, “which can lead to host-level control and access to every credential the appliance stores or brokers”.

NVD scores it 9.8 Critical on CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network-reachable, low complexity, no privileges, no user interaction, full impact on confidentiality, integrity and availability) and 9.3 Critical on CVSS 4.0. The EPSS score on 16 October 2026 was 0.6% (48th percentile): EPSS lags behind newly exploited flaws, and the KEV listing and GTIG’s incident evidence are the stronger signals.

Who is behind it. GTIG attributes the zero-day exploitation, and the SAWFLY web shell and BARECLAW tunneler found on the appliance, to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221 (CrowdStrike: WARP PANDA), active since at least October 2023 and known for zero-days in edge devices, including the Ivanti Connect Secure flaws of early 2024. GTIG gives no victim count or sector breakdown, and warns that after disclosure the group has in the past moved to widespread, opportunistic exploitation. CISA records known ransomware use as “Unknown”.

The fix. BeyondTrust advisory BT26-05 (15 October 2026) provides patch BT26-05-RS for self-hosted Remote Support 24.3.1 to 26.2.3; versions older than 24.3.1 have to be upgraded to a supported version before the patch can be applied. All SaaS tenants were patched on 9 October 2026. The vendor’s advisory and its knowledge-base article KB0024066 (customer login) hold the exact procedure; the patch facts here are as published by CISA, the Canadian Centre for Cyber Security and GTIG.

How an attack works

Indicators and detection

path     /usr/bin/dbus-authd   # SUID root copy of /bin/sh
path     /home/bomgar/sbin/post_boot.d/zz-root-persist   # boot-time sudoers persistence
path     /ns/config/haproxy.conf   # added ACL wswsws / backend webskd3 -> 127.0.0.1:19800
path     /tmp/ingredi_ws   # BARECLAW tunneler
sha256   1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462   # ingredi_ws (BARECLAW)
file     mangoapi.php   # SAWFLY web shell, under .../ingredi/app/laravel/public/
sha256   dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb   # mangoapi.php (SAWFLY)
path     /app_84304470%2Ephp   # request path used to stage the web shell
path     /uidchanarge   # WebSocket path HAProxy forwards to BARECLAW
yara     G_Hunting_Webshell_SAWFLY_1   # GTIG YARA rule
yara     G_Hunting_Backdoor_BARECLAW_1   # GTIG YARA rule

Where to look

• /login audit events: user_changed entries that raise Jump Item or Team roles; user_added, api_account or security_provider events with no change ticket; changes to syslog or outbound event destinations.
• /login successes from residential or commercial VPN address space, and administrative logins outside business hours.
• Session records: file-transfer events, and sessions started by accounts whose roles changed.
• Web server requests to unknown .php paths, and WebSocket upgrades from addresses that are not your support staff or endpoints.
• Gaps in syslog forwarding: GTIG calls an interruption bounded by a single session a strong indicator of tampering.
• GTIG lists no IP addresses or domains for this activity and points to logins from VPN address space instead, so block-lists will not help; the host artefacts above will.
• CISA asks for network and memory forensics on suspected appliances: the on-appliance logs cannot be trusted.

After the first 24 hours

This week

• Confirm the patch or upgrade landed on every Remote Support appliance, including standby, test and disaster-recovery units, and that automatic updates are on where you want them.
• Compare the /login configuration (accounts, roles, Jump Item policies, API accounts, security providers, syslog targets) with a baseline from before late August 2026, and reset default Jump Item roles to No Access.
• Rotate what the appliance could reach even if you found nothing: credentials it stores or injects, API keys, service accounts; revoke standing support sessions.
• Tell your incident-response retainer or MSSP that you run this product. GTIG expects the group to turn opportunistic now that the flaw is public.

Longer term

• Keep remote-support and remote-access appliances off the open internet where the business allows: VPN or allow-listed access, SAML SSO with phishing-resistant MFA, admin interfaces on trusted networks only.
• Ship appliance syslog and session events to a SIEM you control, and alert on gaps: this actor deletes logs as a routine.
• Put remote-access products on a 72-hour patch track: CISA’s KEV deadlines for this class of product are consistently the shortest, and edge devices are where this actor lives.
• Treat every appliance that brokers credentials as Tier 0: segment it, monitor it, and know how to rebuild it from a clean image in a day.

Timeline

References

• Vendor advisory BT26-05 (BeyondTrust)
• Vendor blog: ARMORY CASTLE and BT26-05, what security teams need to know
• BeyondTrust knowledge-base article KB0024066 (customer login)
• Google Threat Intelligence Group: ARMORY CASTLE exploits BeyondTrust (15 October 2026)
• CISA alert: CISA urges patching critical vulnerability in BeyondTrust Remote Support (16 October 2026)
• CISA Known Exploited Vulnerabilities catalog entry
• CISA BOD 26-04 implementation guidance
• Canadian Centre for Cyber Security alert AL26-025 (16 October 2026)
• NVD record
• EPSS score (FIRST)
• BeyondTrust docs: securing a self-hosted appliance
• The Hacker News: China-linked hackers exploited BeyondTrust zero-day (16 October 2026)

Sources and method. Google Threat Intelligence Group report of 15 October 2026 (attack chain, indicators, attribution); CISA alert and KEV entry of 16 October 2026 (affected versions, patch availability, recommended actions); Canadian Centre for Cyber Security alert AL26-025 of 16 October 2026 (patch name and SaaS patch date, relaying BeyondTrust advisory BT26-05); NVD record for CVE-2026-102764, last modified 2026-10-17 (description, CWE, CVSS); FIRST EPSS of 2026-10-16; The Hacker News of 16 October 2026 (the 29 August date only). Every fact comes from those sources; CVSS scores are computed from the published vectors; indicators are defanged; where the sources are silent this advisory says so. Recommendations are Cyberphobia’s own guidance. Free to share: TLP:CLEAR, CC BY 4.0. Version 1.0, 17 October 2026.