BeyondTrust Remote Support flaw exploited as a zero-day since August

BeyondTrust Remote Support flaw exploited as a zero-day since August

16 October 2026: BeyondTrust has patched CVE-2026-102764, a critical authentication bypass (CVSS 4.0 score 9.3) in its Remote Support appliances that an unauthenticated attacker can use to write arbitrary files and take over the system. It was exploited as a zero-day from late August, and the fix is patch BT26-05-RS.

Not yet independently verified. BeyondTrust's own advisory refused our requests, so the affected versions and patch name come from Italy's national CSIRT, which cites it, and the disclosure date from Mandiant. We have not seen BeyondTrust's list of fixed builds. We will update this when it can be confirmed, and remove this note.

Affected versions and the fix

• Affected: BeyondTrust Remote Support 26.2.3 and earlier without patch BT26-05-RS
• Fix: apply BT26-05-RS from BeyondTrust's advisory BT26-05
• Versions before 24.3.1: BeyondTrust will not release a patch; upgrade to a supported version first, then apply it

Italy's national CSIRT describes the flaw as improper validation of the origin of messages received by internal components of the platform, which lets a remote attacker impersonate legitimate entities. It rates the systemic impact as critical and lists exploitation as present.

What the attackers did

Google's Mandiant team says BeyondTrust disclosed the flaw on 15 October, and that during an incident response it found the suspected China-nexus espionage group it now calls ARMORY CASTLE, formerly tracked as UNC5221, exploiting it in late August. After exploitation the group planted a PHP webshell Mandiant calls SAWFLY, made a root-owned copy of the system shell with the SUID bit set to keep root access, and added a startup script that grants the site service account passwordless sudo through the appliance's own configuration template, so the change survives reboots and configuration resets.

The group also used the appliance's bt-secrets utility to try to dump its credential vault, deleted logs, ran a SOCKS5 tunneller called BARECLAW over WebSocket, and edited the HAProxy configuration to reach it from the internet. Inside the Remote Support application it logged in with a compromised administrator account, raised that account's Jump Item and team permissions to Administrator, and used support sessions to take files from users' desktops.

Checking an appliance

Mandiant expects wider exploitation now that the flaw is public. Its traces sit in log files on the appliance's encrypted /home partition, so evidence may need BeyondTrust support to extract. Indicators worth reviewing include a /home/bomgar/sbin/post_boot.d directory with unexpected scripts, a file at /usr/bin/dbus-authd, edits to the sudoers template or haproxy.conf, missing bt-secrets logs, and account permission changes in the syslog. Because the appliance brokers credentials for every system it can reach, treat stored and brokered credentials as exposed on any appliance that shows them. Our remote support software category lists 17 products and our privileged access management category 16.

Update, 22 October 2026: CISA added CVE-2026-102764 to its catalogue of exploited vulnerabilities on 16 October, with a due date of 19 October for US federal agencies, which confirms exploitation. NVD lists Remote Support up to and including 26.2.3 as affected.

Related on TrustList:

• SolarWinds fixes critical Dameware flaw; Tanium patches Threat Response

Sources

• ACN CSIRT Italia alert AL02/261016: BeyondTrust, exploitation of CVE-2026-102764 detected (in Italian), 16 October 2026
• Google Threat Intelligence Group (Mandiant): ARMORY CASTLE exploits BeyondTrust, 16 October 2026
• BeyondTrust security advisory BT26-05 (refused our requests), 15 October 2026
• CISA: Known Exploited Vulnerabilities Catalog (CVE-2026-102764) - 16 October 2026
• NVD: CVE-2026-102764 - 15 October 2026