BeyondTrust Remote Support CVE-2026-102764: exploited zero-day

A remote support appliance holds the credentials and session rights for every machine it reaches. CVE-2026-102764 let an attacker with no account write files to a BeyondTrust Remote Support appliance, and in the intrusion Mandiant documented, that became a web shell, root on the appliance and administrator access to the systems it brokers. Every version up to and including 26.2.3 is affected. The fix is a patch, BT26-05-RS, rather than a newer release.

The attacks came weeks before the fix. On 29 August 2026 an actor hit one BeyondTrust-hosted instance and one self-hosted appliance. BeyondTrust's sensors fired when the actor escalated privileges, but automated triage in its third-party detection platform closed the alerts as false positives; a threat hunt found the hosted instance on 28 September. BeyondTrust shipped the patch on 8 October and disclosed on 15 October with Mandiant. CISA added the CVE to its Known Exploited Vulnerabilities catalog the next day, with a 19 October deadline.

Who is affected

Advisory BT26-05 names Remote Support only. BeyondTrust's blog adds Privileged Remote Access (PRA) as a precaution:

The vendor's CVSS vector describes a network attack needing no privileges or user interaction; beyond that, BeyondTrust says only that it works "under the right conditions". CISA's KEV entry names Remote Support alone.

How CVE-2026-102764 works

BeyondTrust says internal messaging components in Remote Support did not adequately check where the messages they received came from, so a spoofed message could make the appliance perform file operations. The CVE record classes it as CWE-290, authentication bypass by spoofing. BeyondTrust is withholding technical details while customers patch. The patch also closes other paths its variant analysis found.

Mandiant describes the result as arbitrary file upload. In its incident, POST requests to an unusual .php path were followed 11 minutes later by a web shell, SAWFLY, in the web root. From the unprivileged site account the actor reached root through a SUID copy of /bin/sh, kept root across reboots with a startup script, and tried to dump the credential vault. It then raised an administrator account's Jump Item and team roles, pulled documents from an internal endpoint through a support session, and tunneled traffic through BARECLAW.

Is it being exploited?

Yes. CISA added CVE-2026-102764 to KEV on 16 October 2026 with a 19 October due date and forensic triage required. It lists ransomware use as unknown.

• Actor. Google Threat Intelligence Group attributes the exploitation to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221. BeyondTrust agrees with moderate to high confidence.
• Victims. BeyondTrust knows of two, the hosted and self-hosted cases, and as of 16 October had seen no actor activity since August.
• Outlook. Mandiant warns this actor has moved to broad exploitation after past disclosures. That is a forecast; we found no public report of post-disclosure exploitation as of 28 October.

Check your exposure

Confirm in the /appliance interface that BT26-05-RS is installed. Customers cannot audit the appliance's file system, Mandiant notes, so hunt in logs kept elsewhere:

# Reverse proxy, WAF or firewall logs: paths from Mandiant's report
grep -iE "app_84304470(%2E|\.)php|mangoapi\.php|/uidchanarge" proxy-access.log
 
# Appliance syslog exported from your SIEM: role changes to review
grep -i "user_changed" appliance-syslog.log | grep -i "jump_item_role"
 
# Successful console logins, to match against known administrators
grep -i "web/login" appliance-syslog.log | grep -i "success"

An empty result means little unless syslog was forwarded throughout the window; the actor deleted on-box logs.

Fix it

• SaaS: nothing to do on the appliance, though Mandiant says its credential and configuration review still applies.
• Self-hosted, 24.3.1 or later: apply BT26-05-RS from /appliance. If it is not offered, open a BeyondTrust Support case citing BT26-05.
• Self-hosted, older than 24.3.1: upgrade to a supported version, then patch.
• PRA, self-hosted: apply the PRA patch, confirming the package with BeyondTrust Support.

There is no workaround. Mandiant's compensating controls narrow exposure without replacing the patch: restrict /login and /appliance by IP, log full URIs at a reverse proxy, and set the default Jump Item role to No Access.

If you suspect compromise, Mandiant advises:

1. Preserve evidence first: snapshot virtual appliances with memory, or ask BeyondTrust Support to preserve hardware.
2. Block the appliance at the perimeter firewall, leaving its configuration intact.
3. Rebuild from a clean, patched image, restore a pre-window configuration backup, and issue a new TLS certificate.
4. Only then rotate credentials, including API secrets, directory bind accounts and anything typed into a session.

Detect attempts and compromise

Signals published by Mandiant and BeyondTrust:

• Request paths. POSTs to /app_84304470%2Ephp, other unknown .php paths, and WebSocket upgrades to /uidchanarge from outside support ranges.
• Web shell. SAWFLY, mangoapi.php, SHA-256 dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb. It answers 404 unless a specific parameter is present, so probing it can look clean.
• Host artifacts. A SUID /usr/bin/dbus-authd, /home/bomgar/sbin/post_boot.d/zz-root-persist, a NOPASSWD line in /ns/config/sudoers.template, and BARECLAW at /tmp/ingredi_ws, SHA-256 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462, behind a /uidchanarge route in /ns/config/haproxy.conf. These need a forensic image.
• Account changes. user_changed events raising Jump Item or team roles to Administrator, and unticketed user_added, api_account or security_provider events.
• Logins. /login successes from residential or commercial VPN addresses, and off-hours administrator logins.
• Log gaps. A break in syslog forwarding bounded by one session, which Mandiant calls a strong sign of tampering.

Mandiant's post includes YARA rules for both tools; neither public post lists network indicators. If a signal fired, open a Sev 1 case citing BT26-05, rebuild as above, rotate every credential the appliance stored or injected, and review session reports: every endpoint the actor touched is in scope.

Beyond this patch

This is the fourth BeyondTrust remote access flaw added to CISA's KEV catalog since December 2024; the October KEV list shows how many edge products share the pattern. Treat remote support appliances as tier-zero: keep admin consoles off the internet, grant roles by policy, and send logs where root on the box cannot reach them. Treat an automated triage verdict as one input, not a reason to stop looking. Rokkhe's SOC pipeline shows how forwarded events become cases with the evidence kept.