CVE-2026-102764: BeyondTrust Remote Support vulnerability exploited

The BeyondTrust Remote Support vulnerability CVE-2026-102764 lets an unauthenticated attacker write files to the appliance, and Mandiant found a suspected PRC-nexus espionage group, ARMORY CASTLE, using it as a zero-day in late August 2026. CISA added it to the KEV catalog on October 16 with a federal deadline of October 19. If you run a self-hosted Remote Support appliance, preserve its logs, apply BT26-05 today, and treat any box that faced the internet before the patch as possibly compromised.

What makes this one worse than a typical edge bug is what the appliance holds. A remote support server brokers sessions to every endpoint your help desk touches and stores the credentials to do it, so the attacker who owns the box inherits the keys to the estate. Keep that picture in mind, because every step below follows from it.

What happened

BeyondTrust found the intrusion itself, weeks after it started, and the patch shipped a week before anyone said why.

• August 29, 2026: the earliest compromise, against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance, per BeyondTrust’s incident account as reported by SOCRadar.
• September 28: BeyondTrust detects the hosted intrusion while hunting and reproduces the entry vector the same day.
• October 8: BeyondTrust releases the BT26-05 fix, according to BankInfoSecurity. GTIG says SaaS tenants were patched on October 9.
• October 15: public disclosure, the NVD entry and Google Threat Intelligence Group’s write-up.
• October 16: CISA adds it to KEV, with forensicTriage set to yes.

The CNA’s CVSS 4.0 score is 9.3 and NVD’s CVSS 3.1 score is 9.8. EPSS stood at 1.18 percent on October 18. That number tells you little here, because exploitation is already confirmed and BeyondTrust warned that this actor “typically moves to broad exploitation of every instance still unpatched” once a bug goes public.

Which Remote Support versions are affected

GTIG states that all supported Remote Support versions up to and including 26.2.3 are affected.

Deployment	Action
Remote Support SaaS	Patched by BeyondTrust on October 9; no appliance action, but rotate credentials and review configuration
Self-hosted, 24.3.1 to 26.2.3	Apply BT26-05-RS from /appliance, or confirm automatic updates installed it
Self-hosted, older than 24.3.1	Upgrade to a supported version, then apply BT26-05-RS
Privileged Remote Access, self-hosted	Apply the precautionary PRA patch (shared code, no exploitation path found)

If the patch does not show in /appliance, open a support case that references BT26-05. BeyondTrust’s own advisory blocked our fetcher on October 19, so the PRA row comes from BankInfoSecurity’s reading of it. Check the BT26-05 advisory in BeyondTrust’s trust center for your exact build before you close the ticket.

How the BeyondTrust exploit chain works

The bug sits in internal components that “did not adequately validate the origin of the messages it received,” in the vendor’s words on NVD. That missing origin check is enough to write a file into the web root, and from there the attacker builds outward.

Mandiant reconstructed the rest. The actor sent POST requests to /app_84304470%2Ephp, and about 11 minutes later the SAWFLY webshell (mangoapi.php) appeared under ingredi/app/laravel/public/. SAWFLY answers 404 unless a POST carries the parameter _c94mfe, which keeps it quiet for scanners. The webshell runs as the unprivileged site account, so the actor copied /bin/sh to /usr/bin/dbus-authd, set it root-owned and SUID, and had root.

With root came the credential vault. The actor ran /ns/sbin/bt-secrets get vault in several variants, then deleted bt-secrets.log. For persistence it dropped zz-root-persist into post_boot.d, which writes a passwordless sudo line into /ns/config/sudoers.template and rebuilds sudoers, so the access survives reboots and configuration resets. A SOCKS5-over-WebSocket tunneler called BARECLAW listened on localhost port 19800, and a two-line edit to haproxy.conf published it to the internet under the path /uidchanarge.

Then the actor used the product as designed. It logged into the admin portal with compromised Administrator credentials and raised its own Jump Item and team roles from “No Access” to “Administrator”. Then it opened support sessions to internal endpoints and pulled documents out through the native file transfer feature. Throughout, it deleted logs. That is the keys-to-the-estate problem in practice, because none of the downstream activity looks like malware to the endpoints, which see a legitimate support session.

How to detect CVE-2026-102764 exploitation

Here is the hard part. Mandiant found the exploitation evidence in log files that sit on a LUKS-encrypted partition, and watchTowr notes that reading them may need vendor assistance and that patching can erase evidence. So preserve first, then hunt in the two places the attacker cannot rewrite, which are the syslog you already forwarded and the logs of whatever sits in front of the appliance. The two Sigma rules below cover both.

The first rule catches the privilege change that turned appliance access into access to your endpoints. It maps to ATT&CK T1098.

Data source: BeyondTrust Remote Support syslog forwarded to your SIEM (JSON fields as shown in GTIG’s figure 7; map them to your parser’s names)

title: BeyondTrust Remote Support Jump Item Role Raised To Administrator
id: f22beba1-e381-4da6-8063-f74e5968fff6
status: experimental
description: Detects a user_changed event that raises a user's default or team Jump Item role to Administrator, as ARMORY CASTLE did after exploiting CVE-2026-102764.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
author: MarkCyber Research
date: 2026-10-19
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1098
    - cve.2026-102764
logsource:
    product: beyondtrust
    service: remote_support
detection:
    selection:
        event: 'user_changed'
    selection_role:
        - 'new_permissions:jump_item_role:default:name': 'Administrator'
        - 'new_permissions:jump_item_role:teams:name': 'Administrator'
    condition: selection and selection_role
falsepositives:
    - Planned role changes by appliance administrators; match each hit against a change ticket
level: high

The second rule watches the reverse proxy or WAF for the request paths in this intrusion. It maps to T1190, T1505.003 and T1090.

Data source: access logs from the reverse proxy, WAF or load balancer in front of the appliance (Sigma webserver category)

title: BeyondTrust Remote Support Webshell Or Tunnel Request Path
id: 0a761da7-ce2a-4396-ae42-a85d6524ade8
status: experimental
description: Detects requests to an encoded .php path, the SAWFLY webshell or the BARECLAW WebSocket path seen in CVE-2026-102764 exploitation.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
author: MarkCyber Research
date: 2026-10-19
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - attack.command-and-control
    - attack.t1090
    - cve.2026-102764
logsource:
    category: webserver
detection:
    selection_encoded:
        cs-uri-stem|contains: '%2Ephp'
    selection_ioc:
        cs-uri-stem|endswith:
            - '/mangoapi.php'
            - '/uidchanarge'
    condition: 1 of selection_*
falsepositives:
    - Vulnerability scanners probing encoded paths; check whether the request got a non-404 response
level: high

Both rules see only this campaign’s moves. A proxy that logs decoded paths will never show %2E, and the next actor will rename the webshell and the tunnel path. So also follow GTIG’s broader advice and look for unknown .php paths, WebSocket upgrades from outside your support staff’s address ranges, user_added and api_account events with no ticket, and gaps in syslog forwarding. A gap bounded by a single session is a strong sign of tampering. Check file hashes against the two published SHA-256 values and GTIG’s YARA rules. Search back to August 29, 2026.

Mitigation

The order matters more than usual, because rotating credentials on a box the attacker still holds just hands them the new ones.

1. Preserve evidence. Snapshot virtual appliances with memory and export the disk, or request forensic preservation from BeyondTrust Support for hardware and SaaS, then collect syslog, proxy and firewall logs for the whole window.
2. Patch with BT26-05-RS as in the table above. Where compromise is confirmed or unknown, GTIG advises rebuilding from a clean, patched image rather than cleaning, because host-level persistence survives reboot and configuration reset.
3. Restrict /login and /appliance to trusted networks, so only the representative console, customer portal and Jump Client traffic reach the internet.
4. After the patch or rebuild, rotate in dependency order. Start with /appliance and /login administrators, then API secrets, SAML signing keys and directory bind accounts, then every credential in the Remote Support Vault at its target system, and finally anything typed into a support session during the window.
5. Review every support session report since August 29 and put each endpoint that was touched into your hunt scope.

BeyondTrust has been here before, because three earlier command injection flaws in Remote Support and PRA reached KEV, the last on February 13, 2026. We would now treat a remote support appliance as tier-zero infrastructure, with its own log forwarding and change alerts, which is the security engineering work we do for clients. We saw the same pattern of a privileged access appliance at the edge on SonicWall SMA1000 on October 12.

Bottom line

Preserve the appliance’s logs, apply BT26-05 today, and put the two Sigma rules on your syslog and proxy data back to August 29. If the box was internet-facing before the patch, rebuild it and then rotate every credential it brokered.