BeyondTrust Remote Support CVE-2026-102764 (CVSS 9.3): unauthenticated file operations on the appliance, exploited as a zero-day from late August by PRC-nexus Armory Castle (UNC5221); SaaS patched 9 Oct, self-hosted needs BT26-05-RS
On 15 October 2026 BeyondTrust disclosed CVE-2026-102764 in BeyondTrust Remote Support (formerly Bomgar): improper origin validation in an internal messaging component lets an unauthenticated remote attacker perform file operations on a vulnerable appliance and reach host-level control. The Hacker News reports CVSS 9.3 with the disclosure. Google Threat Intelligence Group / Mandiant says suspected PRC-nexus espionage actor Armory Castle (formerly UNC5221 / Warp Panda) exploited the flaw as a zero-day in late August 2026 during an incident-response engagement, then deployed the SAWFLY PHP webshell (encrypted C2 via a custom Base32/RC4 channel), escalated to root via an SUID copy of /bin/sh, queried appliance secrets with bt-secrets, and planted reboot-surviving sudoers persistence through post_boot.d. BeyondTrust's timeline (via THN) places first known zero-day use on a single self-hosted appliance on 29 August 2026. Mandiant says the flaw affects all supported Remote Support versions up to 26.2.3; Remote Support SaaS tenants were patched by BeyondTrust on 9 October 2026 (no customer action for the appliance patch); self-hosted customers on 24.3.1 or later should apply the BT26-05-RS patch from the /appliance interface (or confirm automatic apply); older than 24.3.1 must upgrade first. Mandiant warns any internet-reachable vulnerable appliance during the window should be treated as potentially compromised until reviewed. Primary research: Mandiant/GTIG. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on 16 October 2026 with a 19 October deadline for US federal agencies and a requirement to perform forensic triage, not just patch. Vendor advisory: BeyondTrust BT26-05. Wire: The Hacker News 16 Oct.
- Product
- BeyondTrust Remote Support (formerly Bomgar) — self-hosted appliances and SaaS
- Versions
- Affected: all supported Remote Support versions up to 26.2.3 (Mandiant). SaaS: BeyondTrust applied the patch to all tenants on 9 Oct 2026. Self-hosted 24.3.1 or later: apply BT26-05-RS. Self-hosted older than 24.3.1: upgrade to a supported build then apply the patch.
- CVSS
- 9.3 (CVE-2026-102764 — BeyondTrust disclosure as reported by The Hacker News 16 Oct)
- Exploited in Australia?
- unknown
- Patch to
- Remote Support SaaS: already patched by BeyondTrust (9 Oct). Self-hosted: apply BT26-05-RS (24.3.1+) or upgrade then patch. Treat internet-exposed appliances that were vulnerable during the window as potentially compromised; review for SAWFLY webshell, unexpected SUID binaries, post_boot.d persistence, and bt-secrets log tampering per Mandiant guidance. CISA's 16 October KEV entry also asks for forensic triage of exposed appliances, so collect logs and images before rebuilding.
Primary: Google Mandiant / GTIG — Armory Castle exploits BeyondTrust Remote Support CVE-2026-102764 (published with 15 Oct disclosure) · Vendor: BeyondTrust — Security Advisory BT26-05 (Remote Support CVE-2026-102764) · CVE: CVE-2026-102764 · The Hacker News — China-linked Armory Castle exploited BeyondTrust Remote Support zero-day (16 Oct 2026)