CVE-2026-102764BeyondTrust Remote Support authentication bypass (CVE-2026-102764) exploited as zero-day

Executive summary

CVE-2026-102764 is an authentication bypass by spoofing (CWE-290) in internal messaging components of BeyondTrust Remote Support (RS). The components do not adequately validate the origin of received messages, which lets an unauthenticated remote attacker perform file operations on the appliance. BeyondTrust rates it CVSS 4.0 9.3; NVD lists CVSS 3.1 9.8. All RS versions up to and including 26.2.3 are affected.

Google Threat Intelligence Group (GTIG) and Mandiant observed zero-day exploitation from late August 2026 and attribute it to ARMORY CASTLE (formerly UNC5221), a suspected PRC-nexus espionage actor. Observed post-exploitation included web shell deployment (SAWFLY), root escalation via an SUID binary, dumping of the appliance credential vault, boot persistence, log deletion, a SOCKS5-over-WebSocket tunneler (BARECLAW) and lateral movement through BeyondTrust admin sessions to downstream endpoints.

BeyondTrust disclosed the flaw on 2026-10-15 (advisory BT26-05) and states that SaaS tenants were already patched; self-hosted appliances need patch BT26-05-RS. CISA added the CVE to KEV on 2026-10-16 with a due date of 2026-10-19 and a forensic triage requirement. Because patching does not remove persistence, any internet-reachable appliance that ran a vulnerable version during the exploitation window should be treated as potentially compromised until reviewed.

Threat assessment

Risk is critical for self-hosted RS appliances reachable from the internet. RS brokers privileged access to downstream systems and stores credentials, so a compromised appliance gives an attacker both a credential haul and a trusted channel into internal endpoints. Mandiant reports the actor reached root and gained the ability to modify files that survive reboot and configuration reset.

Mandiant expects possible wider exploitation attempts, noting that ARMORY CASTLE has previously exploited edge vulnerabilities opportunistically after public disclosure (Ivanti Connect Secure, 2024). Rapid7 reports a technical analysis showing unauthenticated file upload leading to code execution as the site user and states that a Metasploit module is available, which lowers the bar for further actors. Shadowserver tracks more than 1,400 exposed BeyondTrust remote support instances (per BleepingComputer; patch state unknown).

BeyondTrust products have a history of exploited flaws (CVE-2024-12356, CVE-2024-12686, CVE-2026-1731, all in KEV). SaaS customers are patched but should still perform the credential and configuration review, since one BeyondTrust-hosted instance was also compromised on 2026-08-29 according to Rapid7.

Timeline

1. 2026-11-02

   Rapid7 updates its analysis; reports unauthenticated file upload to RCE as the site user and an available Metasploit module. Source

2. 2026-10-19

   Rapid7 publishes Emergent Threat Response on CVE-2026-102764. Source

3. 2026-10-16

   CISA adds CVE-2026-102764 to KEV (due date 2026-10-19, forensic triage required). Source

4. 2026-10-15

   BeyondTrust publishes BT26-05 and CVE record; patch BT26-05-RS for self-hosted RS 24.3.1 to 26.2.3. Source

5. 2026-10-15

   GTIG/Mandiant publish ARMORY CASTLE exploitation report with TTPs, IOCs and YARA rules. Source

6. 2026-10-09

   BeyondTrust patches all RS SaaS tenants (BleepingComputer reports 2026-10-08). Source

7. 2026-09-30

   Mandiant corroborates findings on the compromised self-hosted appliance. Source

8. 2026-09-28

   BeyondTrust identifies and contains the compromise of a BeyondTrust-hosted instance. Source

9. 2026-08-29

   Earliest dated compromises: one BeyondTrust-hosted instance and one self-hosted appliance. Source

Affected & exposure

BeyondTrust Remote Support (self-hosted, physical and virtual appliances): all versions up to and including 26.2.3 without patch BT26-05-RS.

Patch BT26-05-RS is available for RS 24.3.1 through 26.2.3; appliances older than 24.3.1 must first upgrade to a supported version, then apply the patch.

BeyondTrust Remote Support SaaS: patched by BeyondTrust before disclosure (2026-10-09 per GTIG and Rapid7, 2026-10-08 per BleepingComputer); no appliance action required.

BeyondTrust Privileged Remote Access (PRA) self-hosted: shares the affected code; BeyondTrust found no way to exploit it in PRA but released a precautionary patch and recommends applying it immediately (per Rapid7 and BleepingComputer). Not listed as affected in the CVE record.

Exploitation in the wild

Zero-day exploitation since late August 2026; Rapid7 dates two compromises to 2026-08-29 (one BeyondTrust-hosted instance, one self-hosted appliance). BeyondTrust contained the hosted compromise on 2026-09-28; Mandiant corroborated the self-hosted findings on 2026-09-30.

Attribution (GTIG/Mandiant): ARMORY CASTLE, formerly UNC5221, suspected PRC-nexus espionage. BleepingComputer reports CrowdStrike tracks the actor as Warp Panda.

Initial access via unauthenticated POST requests creating a staging PHP file with a randomized app_*.php name; about 11 minutes later the SAWFLY web shell (mangoapi.php, SHA-256 dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb) appeared under the site web root (ingredi/app/laravel/public/). SAWFLY returns HTTP 404 to requests lacking its parameter.

Privilege escalation via a copied shell binary with root ownership and SUID bit at /usr/bin/dbus-authd; persistence via /home/bomgar/sbin/post_boot.d/zz-root-persist adding a passwordless sudo entry through /ns/config/sudoers.template.

Credential theft by abusing the native bt-secrets CLI to dump site- and appliance-level vault contents, followed by deletion of /home/bomgar/log/bt-secrets.log and wide log wiping (auth, ssl, http-access, php-fpm, /var/log/messages, /tmp/sshauth.*).

BARECLAW tunneler (/tmp/ingredi_ws, SHA-256 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462) listening on localhost TCP 19800, exposed through an added /uidchanarge WebSocket route (ACL wswsws, backend webskd3) in /ns/config/haproxy.conf.

Lateral movement: login with a compromised Administrator account, Jump Item and Team roles raised from No Access to Administrator, remote sessions to internal endpoints with file-system access and document exfiltration via native file transfer.

Rapid7 reports a public technical analysis and a Metasploit module (status as of its 2026-11-02 update).

Detection & hunting

Most host artefacts sit on the appliance filesystem, which customers cannot audit directly; coordinate host-level review with BeyondTrust Support. SOC-side detection relies on appliance syslog forwarded to a SIEM, reverse-proxy/WAF logs in front of the appliance, and endpoint telemetry on systems reached via RS sessions. Field names below are generic and must be mapped to your parsers. Absence of known IOCs does not prove an appliance is clean.

index=beyondtrust sourcetype=*bomgar* OR sourcetype=*beyondtrust* "user_changed"
| search ("jump_item_role" OR "teams") "Administrator"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as src_ip by host, user, who
| convert ctime(first_seen) ctime(last_seen)

index=beyondtrust ("user_added" OR "api_account" OR "security_provider" OR "syslog" OR "outbound_event" OR ("login" "web/login" "success"))
| eval hour=strftime(_time,"%H")
| stats count values(hour) as hours values(src_ip) as src_ip by host, event, user
| sort - count

// Adapt table and columns to your proxy/WAF schema
CommonSecurityLog
| where DestinationHostName in~ ("<rs-appliance-fqdn>")
| where RequestURL matches regex @"(?i)/app_[^/]*\.php|mangoapi\.php|/uidchanarge" or (RequestURL endswith ".php" and RequestMethod == "POST")
| summarize count(), min(TimeGenerated), max(TimeGenerated) by SourceIP, RequestURL, RequestMethod

index=beyondtrust host=<rs-appliance>
| sort 0 _time
| streamstats current=f last(_time) as prev_time by host
| eval gap_min=round((_time-prev_time)/60,1)
| where gap_min > 30
| table host prev_time _time gap_min
| convert ctime(prev_time) ctime(_time)

DeviceFileEvents
| where SHA256 in ("dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb", "1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462")
   or FileName in~ ("mangoapi.php", "ingredi_ws", "dbus-authd", "zz-root-persist")
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessAccountName

Mitigation

• Self-hosted RS 24.3.1 to 26.2.3: apply BT26-05-RS immediately via /appliance or confirm that automatic updates installed it; if the patch is not offered, open a BeyondTrust Support case referencing BT26-05.
• Self-hosted RS older than 24.3.1: upgrade to a supported version, then apply BT26-05-RS. Upgrading does not remove prior compromise.
• Self-hosted PRA: apply the precautionary patch now and confirm the correct package with BeyondTrust Support.
• Treat internet-reachable appliances that were vulnerable during the window (late August 2026 onward) as potentially compromised: preserve evidence first (VM snapshot with memory, disk export, external syslog, WAF/proxy and firewall logs), block inbound traffic at the perimeter firewall rather than in /appliance, restrict egress to BeyondTrust update and licensing endpoints.
• If compromise is confirmed or cannot be ruled out, rebuild from a clean, fully patched image; host persistence survives reboot and configuration reset. Restore only pre-exposure backups.
• Rotate credentials only after patching or rebuilding, in this order per Mandiant: /appliance admins, /login admins and local users, API secrets, security provider bind accounts and SAML keys, Vault and PRA credentials (at the target), integration credentials, and any credential typed into a support session during the window.
• Review /login configuration against a pre-window baseline: users and roles (Jump Item roles raised to Administrator), group and session policies, API accounts, security providers, Jump Items, Jumpoints, outbound event and syslog destinations; hunt on every endpoint touched by RS sessions in the window.
• Hardening: restrict /login and /appliance by source IP, front the appliance with a WAF or reverse proxy that logs full URIs, enforce SAML SSO with phishing-resistant MFA, set default Jump Item role to No Access, forward syslog over TLS to a SIEM with multi-month retention.
• Federal agencies: follow CISA KEV required action (BOD 26-04 and Forensics Triage Requirements; due date 2026-10-19).

Update log

Sources

1. CVE-2026-102764 CVE record (CVE Program, cvelistV5)
2. CISA Known Exploited Vulnerabilities catalog (JSON mirror)
3. Google Threat Intelligence: ARMORY CASTLE exploits BeyondTrust
4. Rapid7 ETR: CVE-2026-102764 BeyondTrust Remote Support authentication bypass exploited in the wild
5. OpenCVE: CVE-2026-102764 (NVD CVSS 3.1 9.8, CNA CVSS 4.0 9.3)
6. BleepingComputer: BeyondTrust patches zero-day exploited in attacks since August