BeyondTrust Remote Support Zero-Day CVE-2026-102764 Hands Attackers the Keys to Downstream Systems

YuSMP Group Editorial Team Editorial team, YuSMP Group

The short version

What did BeyondTrust and Google disclose?

On October 15, 2026 BeyondTrust published advisory BT26-05 for CVE-2026-102764, a flaw in Remote Support, the remote help-desk platform formerly sold as Bomgar. An internal messaging component does not properly confirm where a message comes from, so an attacker with no credentials can perform file operations on the appliance. BeyondTrust rates it 9.3 under CVSS v4.0.

The same day, Google Threat Intelligence Group and Mandiant published their incident response findings. They attribute the attacks to ARMORY CASTLE, a suspected China-nexus espionage actor previously tracked as UNC5221 and known for zero-days in edge devices such as Ivanti Connect Secure. Exploitation started around August 29, against one BeyondTrust-hosted and one self-hosted appliance. BeyondTrust rolled out the fix to its cloud customers by October 9, ahead of public disclosure. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 16.

How did the attackers use the appliance?

Mandiant’s write-up shows a full takeover, not a quick smash-and-grab. The attackers uploaded a PHP web shell Google calls SAWFLY, copied a shell binary with the SUID bit set to get root, and added sudoers changes through a boot-time script so access survived reboots and configuration resets. They then ran the appliance’s own secrets utility to dump its credential vault and deleted the related logs.

With administrator credentials in hand, they logged in to the web console, raised an account’s permissions to reach every Jump Item, opened support sessions to internal endpoints and pulled documents off user desktops through the product’s built-in file transfer. A custom tunneler, BARECLAW, was hidden behind a modified HAProxy route to give them a SOCKS5 path into the network that looked like normal web traffic. Google says only a small number of organizations are known to be affected, but warns that this actor has historically moved to wide, opportunistic exploitation once a bug becomes public.

Who is exposed?

Any organization running self-hosted BeyondTrust Remote Support 26.2.3 or earlier, especially where the public support portal or the /login and /appliance admin paths are reachable from the internet. Self-hosted appliances on 24.3.1 or later can install BT26-05 from the /appliance interface; older versions must first upgrade. Privileged Remote Access shares the affected code; BeyondTrust says it has found no exploitation path there but has shipped a precautionary patch.

The risk also extends to companies that never run the product themselves. Managed service providers, outsourced IT desks and software vendors often reach customer machines through BeyondTrust. If your supplier’s appliance was compromised, the attacker inherited the sessions and stored credentials that lead into your environment.

What it means for US & EU teams

Remote support and privileged access platforms are now a favourite target for the same reason they are useful: one box holds trusted, pre-approved paths into hundreds of machines. Teams building and running software should treat them like production identity systems. That means admin consoles behind SSO with phishing-resistant MFA, default “No Access” roles granted by policy, credentials injected from an external vault rather than stored on the appliance, and syslog shipped off-box so an attacker cannot quietly erase it.

Vendor access is the second lesson. Ask every supplier with remote access to your systems which tool they use, which version and whether they have applied BT26-05. For EU organizations in scope of NIS2 or DORA, a compromise that reached production through a third-party support tool is likely a reportable incident and a supply-chain risk regulators expect to be managed and documented.

What to do this week

1. Patch. Apply BT26-05 to every self-hosted Remote Support and Privileged Remote Access appliance; upgrade unsupported versions first.
2. Restrict admin paths. Limit /login and /appliance to trusted IP ranges or a VPN, and put a reverse proxy or WAF with full URI logging in front of the portal.
3. Hunt. Use Google’s published hashes and YARA rules for SAWFLY and BARECLAW; look for unknown .php files, changes to the HAProxy config and sudoers template, and user_changed events that raised Jump Item roles.
4. Rotate secrets after patching. Appliance and portal admin passwords, API client secrets, SAML signing keys, vault entries and integration credentials, plus anything typed into support sessions during the exposure window.
5. Rebuild if in doubt. If an internet-facing appliance was unpatched since late August and shows any indicator, snapshot it for forensics and redeploy from a clean image; a reset does not remove host-level persistence.
6. Check your vendors. Confirm patch status with MSPs and suppliers that reach your systems through BeyondTrust.

Frequently asked questions

Sources

Google Threat Intelligence Group / Mandiant — ARMORY CASTLE Exploits BeyondTrust (October 15, 2026)
BeyondTrust — Security Advisory BT26-05 (October 15, 2026)
CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 16, 2026)
Cybersecurity Dive — China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign (October 16, 2026)
SecurityWeek — Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day (October 2026)