BeyondTrust Remote Support CVE-2026-102764: Zero-Day Exploited Since August, Now in CISA KEV

BeyondTrust has patched CVE-2026-102764 (advisory BT26-05), a critical flaw in Remote Support, its remote IT support product formerly called Bomgar. An internal messaging component did not properly check where messages came from. Under the right conditions, an unauthenticated remote attacker could use this to perform file operations on the appliance. The flaw was exploited as a zero-day. BeyondTrust says the attacker first used it on 29 August 2026, against one BeyondTrust-hosted (SaaS) instance and one self-hosted appliance. Google Threat Intelligence Group (GTIG) attributes the activity to ARMORY CASTLE, which it describes as a "suspected PRC-nexus espionage threat actor (formerly tracked as UNC5221)". BeyondTrust separately assesses "with moderate to high confidence" that the activity belongs to the same China-nexus actor. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-16, with a due date of 2026-10-19 for US federal agencies, and requires forensic triage.

Technical Information

• Vulnerability: "Improper Origin Validation in an Internal Messaging Component" (CWE-290, authentication bypass by spoofing). BeyondTrust is deliberately holding back technical details while customers patch.
• Severity: BeyondTrust (CNA) scores it CVSS 4.0 9.3 Critical. NVD's own CVSS 3.1 score is 9.8 Critical. CISA's SSVC entry rates exploitation as active, automatable yes, technical impact total.
• Exploitation: BeyondTrust, Mandiant and CISA all confirm exploitation. BeyondTrust says it knows of two affected customers and has "not seen evidence of adversary activity since August". Mandiant warns that ARMORY CASTLE has a history of moving to broad, opportunistic exploitation after a vulnerability becomes public, and that defenders should prepare for that possibility here. No broad campaign had been reported at the time of writing.
• Post-exploitation (Mandiant): once inside, the actor planted a web shell (SAWFLY), escalated to root on the appliance, tried to pull credentials from the appliance's vault, set up persistence that survives reboots, and deleted logs. It then used the Remote Support admin console to give itself administrator rights over Jump Items and launched support sessions against internal endpoints, copying files out with the product's own file-transfer feature. It also tunneled traffic through the appliance with a custom tool, BARECLAW.
• Timeline (BeyondTrust, Mandiant, CISA):
  • 29 Aug 2026: zero-day exploited against two customers.
  • 28 Sep: BeyondTrust's threat hunting finds the affected SaaS instance, which is contained within 27 minutes of detection.
  • 30 Sep: Mandiant shares findings from the self-hosted customer.
  • 8–9 Oct: patch released, and SaaS instances patched. The BeyondTrust blog gives 8 October; the advisory and Mandiant say SaaS was patched "as of Oct 9".
  • 15 Oct: coordinated public disclosure.
  • 16 Oct: CISA alert and KEV listing.
• KEV entry: "BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability", dateAdded 2026-10-16, dueDate 2026-10-19, forensicTriage Yes, known ransomware campaign use Unknown.

Affected Product Versions

All Remote Support versions up to and including 26.2.3 are affected. Mandiant notes that upgrading "closes the vulnerability but does not remediate prior exposure". It advises treating any appliance that was reachable from the internet on a vulnerable version during the exploitation window as potentially compromised until it has been reviewed.

Workaround and Mitigation

1. Patch now with BT26-05-RS, or upgrade and then patch if you run a version older than 24.3.1. If the patch does not appear in /appliance, open a BeyondTrust support case that cites BT26-05.
2. Reduce exposure. Expose only the services that users and customers need, and restrict the /login and /appliance administrative interfaces to trusted networks. Restrict outbound traffic from the appliance (CISA, BeyondTrust, Mandiant).
3. Get logs off the appliance (BeyondTrust, CISA). Forward syslog and session events to your SIEM. This actor deletes local logs.
4. Hunt for the behavior (BeyondTrust, CISA). Look for unrecognized privileged or admin sessions, especially from residential broadband or commercial VPN addresses. Also look for unknown script files in web directories, web service accounts spawning shells, Jump Item or Team roles raised to Administrator, and gaps in log forwarding that start and end within a single session.
5. If you suspect compromise (CISA, Mandiant):
   • Isolate the appliance.
   • Take a snapshot or forensic image before you change anything.
   • Collect WAF, reverse-proxy and firewall logs for the exposure window.
   • Rebuild from a known-good state and apply the patch.
   • Only then rotate every credential the appliance stored or injected, revoke active support sessions, and review new MFA registrations on privileged accounts. Rescana's reasoning for this order: rotating before the rebuild risks handing the new credentials to an attacker who may still control the appliance.

Indicators of Compromise

Published by Mandiant. The full set is in a GTI Collection for registered users. Validate these before you block on them. BeyondTrust notes that this actor changes its tooling for each victim, so behavioral hunting matters more than hashes.

The public sources publish no network indicators (IPs or domains). Mandiant also publishes YARA hunting rules. No MITRE ATT&CK mapping is published.

Sources

• BeyondTrust security advisory BT26-05
• Google Threat Intelligence: ARMORY CASTLE exploits BeyondTrust
• CISA alert, 16 October 2026
• NVD entry for CVE-2026-102764
• BeyondTrust BT26-05 blog

What This Means for Your Third-Party Risk Program

A remote support appliance holds and passes on privileged access for every system it reaches. If a vendor or MSP ran a vulnerable self-hosted instance, the credentials and sessions it brokered into your environment may be exposed. A fast but accurate review starts by confirming which suppliers use BeyondTrust Remote Support, and whether they run it themselves or on BeyondTrust's SaaS, rather than assuming either way. Then ask them:

1. Do you use BeyondTrust Remote Support or PRA to access our systems or data? Is it self-hosted or SaaS?
2. If self-hosted, what version are you running, and when did you apply BT26-05-RS?
3. Was the appliance reachable from the internet while it ran a vulnerable version? Have you reviewed it for compromise using logs kept off the appliance?
4. After patching, did you rotate the credentials the appliance stored or injected for our environment?

Forward this to your TPRM owner: BeyondTrust Remote Support CVE-2026-102764 (BT26-05) was exploited as a zero-day from 29 August and is in CISA KEV, due 19 October. Please check which vendors and MSPs use self-hosted Remote Support to reach us, and send them the four questions above.
If you'd like help working out which of your vendors and MSPs run BeyondTrust Remote Support self-hosted (on-prem), book a demo.