BeyondTrust Remote Support flaw CVE-2026-102764 exploited as zero-day, added to CISA KEV catalog

BeyondTrust has released a fix for CVE-2026-102764, a critical vulnerability in its Remote Support product, formerly known as Bomgar, that affects versions 26.2.3 and earlier. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 16 and published guidance urging organizations that run self-hosted appliances to act immediately. According to Mandiant, a suspected China-nexus espionage actor exploited the bug as a zero-day in late August, well before public disclosure.

BeyondTrust disclosed the issue on October 15, according to Mandiant. The Hacker News, which reported a CVSS score of 9.3, quoted the vendor as saying internal Remote Support components did not properly check where incoming messages came from, which under certain conditions could allow file operations on the appliance. CISA describes the flaw as an authentication bypass, while Mandiant said an unauthenticated remote attacker can use it to manipulate files, potentially gaining host-level control and reaching all credentials the device stores or brokers. The fix is patch BT26-05-RS under advisory BT26-05. Mandiant said BeyondTrust applied it to all SaaS tenants on October 9, so hosted customers need no appliance update, although credential and configuration reviews still apply. Self-hosted systems on version 24.3.1 or later need the patch installed, or confirmed via automatic updates, while older releases must first be upgraded to a supported version; Mandiant noted that upgrading does not remediate earlier exposure.

Mandiant said it uncovered the activity during an incident response engagement, and GTIG attributes it to ARMORY CASTLE, a group formerly tracked as UNC5221. After exploitation, the actor planted an obfuscated PHP web shell that Mandiant calls SAWFLY, obtained root by creating a copy of the system shell with SUID permissions, tried to dump stored credentials with a built-in BeyondTrust command-line tool, and added a startup script that altered the sudoers template so unrestricted root access would survive reboots and configuration resets. Mandiant also described a custom SOCKS5 tunneler named BARECLAW, made reachable from the internet through edits to the appliance's HAProxy configuration, repeated log deletion, and abuse of an administrator account whose Jump Item permissions were raised so the actor could open remote sessions to internal endpoints and copy documents such as software inventories.

Beyond patching, CISA advised limiting external exposure of Remote Support appliances to required services, keeping administrative interfaces on trusted networks, and running network and memory forensics. Where compromise is suspected, the agency recommends isolating the appliance, preserving a snapshot or forensic image, forwarding logs to a SIEM, and hunting for unfamiliar privileged sessions, scripts or gaps in logging. It then calls for rebuilding from a known-good state, patching, rotating every credential the device held, revoking active support sessions and checking new MFA enrollments on privileged accounts. The Hacker News reported that federal civilian agencies have until October 19 to remediate, and Canada's Cyber Centre has also issued an advisory on the flaw.

According to The Hacker News, a BeyondTrust timeline indicates the zero-day exploitation of one self-hosted appliance dates to August 29, and the vendor began hunting for similar activity after another security device provider's compromise became public on September 27. GTIG said ARMORY CASTLE has been active since at least October 2023 and has previously exploited edge appliances. Mandiant warned that the group has historically moved to broad, opportunistic exploitation once a flaw is disclosed, as seen in 2024 after the Ivanti flaws CVE-2023-46805 and CVE-2024-21887, and said any vulnerable appliance exposed to the internet during the exploitation window should be "treated as potentially compromised until it has been reviewed".