What happened
On 15 October 2026 BeyondTrust published advisory BT26-05 for CVE-2026-102764, a flaw in internal messaging components of Remote Support. The components did not check where incoming messages came from. An unauthenticated attacker on the network can use that to perform file operations on the appliance, and Mandiant reports that in practice it means uploading arbitrary files.
It was a zero-day. BeyondTrust says the attacker first used it on 29 August 2026, against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. BeyondTrust found the hosted case during a hunt on 28 September and contained it 27 minutes after detection. Mandiant investigated the self-hosted case.
Google Threat Intelligence Group and Mandiant attribute the activity to ARMORY CASTLE, a suspected PRC-nexus espionage group formerly tracked as UNC5221. CrowdStrike tracks the same cluster as WARP PANDA. The same group was behind earlier zero-days in Citrix NetScaler and Ivanti Connect Secure.
Who is affected
- Self-hosted Remote Support, all versions up to and including 26.2.3. This is the group that has to act.
- Remote Support SaaS: BeyondTrust patched every SaaS instance by 9 October 2026. No action is needed for the vulnerability itself.
- Privileged Remote Access (PRA): BeyondTrust says it found no way to exploit PRA, but PRA shares the affected code, so it released the patch for PRA as well and recommends self-hosted PRA customers apply it.
No credentials and no user interaction are needed. Any appliance reachable from the internet on an affected version is in scope.
What is confirmed
Score. BeyondTrust rates it CVSS 4.0 9.3, Critical (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). The weakness is CWE-290, authentication bypass by spoofing.
Fix. Patch BT26-05-RS covers versions 24.3.1 to 26.2.3. Appliances older than 24.3.1 must be upgraded before the patch can be applied. Appliances subscribed to automatic updates in the /appliance interface receive it automatically; everyone else applies it by hand.
Exploited in the wild. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 16 October 2026, with a due date of 19 October 2026 for US federal agencies and a forensic triage requirement.
What the attacker did after getting in. Mandiant's write-up of the self-hosted case describes a hands-on operator who knew the appliance well:
- planted the SAWFLY PHP web shell (
mangoapi.php) in the appliance's web root; - copied
/bin/shto/usr/bin/dbus-authd, made it owned by root and set the SUID bit, giving a root shell on demand; - tried to dump the appliance's credential vault with the built-in
/ns/sbin/bt-secretsutility, then deleted its log; - added a boot script that grants the web service account passwordless sudo through the appliance's sudoers template, so the access survives reboots and configuration resets;
- raised a compromised admin account's Jump Item and Team permissions from No Access to Administrator, then used Remote Support sessions to reach internal machines and copy files;
- ran the BARECLAW SOCKS5-over-WebSocket tunneler and edited HAProxy so it was reachable from the internet;
- deleted host, web server and application logs along the way.
What is not known
- The technical details of the bug. BeyondTrust is withholding them while self-hosted appliances are patched.
- How many appliances are compromised. As of 16 October BeyondTrust knew of two affected customers and no attacker activity after August. That will change if mass exploitation starts.
- Whether other groups will join. Mandiant warns that ARMORY CASTLE and others have historically exploited broadly once a bug becomes public. Plan as if they will.
What to do now
- Patch today. Apply BT26-05-RS to every self-hosted Remote Support and PRA appliance. If you are below 24.3.1, upgrade first. Confirm the patch is installed rather than assuming automatic updates ran.
- Hunt, because the patch will not evict anyone. The patch closes the way in. It does not remove a web shell, a SUID shell, a boot script or a changed permission that is already there. Work through the checklist below on every appliance that was reachable from the internet on a vulnerable version.
- Get logs off the box. Forward appliance syslog and session events to your SIEM. This actor deletes local logs, so the off-box copy may be the only record you have. Start with what was forwarded before today.
- Shrink the exposure. Expose only the parts of the appliance your users and customers need, keep the admin interface on trusted networks, and allow outbound traffic only to destinations it needs.
- If you find anything, treat it as a breach. Image the appliance before rebuilding it. Rotate every credential it stored or injected. Watch those accounts for logins outside a managed session or from new places, and review new MFA registrations on privileged accounts.
Hunt checklist
These are the artifacts Mandiant recovered from the self-hosted case. ARMORY CASTLE changes tooling and infrastructure between victims, so a clean result here is not proof you are clean. Pair it with the behaviour checks after the table.
| Where to look | What would be suspicious |
|---|---|
/usr/bin/dbus-authd | Exists, owned by root with the SUID bit set. It is a copy of /bin/sh. |
/home/bomgar/sbin/post_boot.d/ | Any script you did not put there, especially zz-root-persist. |
/ns/config/sudoers.template | A line granting the site service account ALL=(ALL) NOPASSWD: ALL. |
/ns/config/haproxy.conf | An ACL or backend you did not add, such as an ACL on /uidchanarge or a backend pointing at 127.0.0.1:19800. |
| Web root under the site service account | Unknown PHP files, such as mangoapi.php, and POST requests to unfamiliar .php paths in access logs. |
/tmp/ | Unknown binaries, such as ingredi_ws, or a process listening on a local port such as 19800. |
/home/bomgar/log/bt-secrets.log | Missing or emptied, or entries showing bt-secrets get … vault. |
| Remote Support syslog in your SIEM | user_changed events that move Jump Item or Team roles from No Access to Administrator. |
Behaviour to hunt for, as BeyondTrust recommends:
- admin or privileged sessions from residential broadband or commercial VPN addresses that you cannot tie to a known administrator or ticket;
- new script files in web directories, and the web service account starting shells;
- account, permission or session-policy changes nobody asked for;
- gaps in log forwarding that start and end inside a single session.
Mandiant's post lists file hashes and YARA rules for SAWFLY and BARECLAW. BeyondTrust customers can also request its threat hunting package for this actor through the trust portal.
The poster
We made a one-page poster of the response steps for teams to print or share. Its full text is below the image.
Remote Support turned backdoor
CVE-2026-102764 · CVSS 9.3 · Remote Support 26.2.3 and earlier.
- Patch. Self-hosted 24.3.1 to 26.2.3: apply BT26-05-RS. Older than 24.3.1: upgrade first.
- Hunt. Treat remote support exposure as high risk. Scan for vulnerable versions and active sessions.
- Restrict. Limit access to trusted networks only. Disable internet access and remove unused accounts.
- Harden. Enable MFA, enforce strong credentials, and monitor for suspicious activity.
The context. Remote support tools are built to help, not for attackers. This vulnerability turns trusted access into a direct path in. Once exposed, attackers can bypass security controls, move laterally and gain persistent access to your network.