BeyondTrust Remote Support Just Got Rooted by the People It Was Meant to Keep Out

The appliance whose entire personality is “secure remote access” got owned by an unauthenticated file-operation bug that Mandiant says a suspected PRC-nexus crew abused as a zero-day since late August. CVE-2026-102764. CVSSv4 9.3. BeyondTrust advisory BT26-05. CISA KEV on October 16 with a federal due date of October 19 and forensic triage required. If your Bomgar-shaped box was internet-reachable on a vulnerable build during that window, you are not debating CVSS. You are debating whether to rebuild or cosplay as a case study.

BeyondTrust disclosed CVE-2026-102764 on October 15, 2026: improper origin validation in an internal messaging component of Remote Support (formerly Bomgar). Under the right conditions, a remote attacker can perform file operations on the appliance. SaaS tenants were patched on October 9. Self-hosted customers on 24.3.1 through 26.2.3 need the BT26-05-RS patch. Anything older than 24.3.1 must upgrade first, then patch. Mandiant’s Google Threat Intelligence Group blog the same week named the actor ARMORY CASTLE (previously UNC5221), documented SAWFLY and BARECLAW, and described credential vault dumping, SUID backdoors, HAProxy routing tricks, and log deletion. CISA’s October 16 alert repeated the patch-hunt-rotate mantra with BOD 26-04 language attached.

What the bug actually is

CISA catalogs CVE-2026-102764 as authentication bypass by spoofing (CWE-290) in BeyondTrust Remote Support that allows remote file operations on the appliance. BeyondTrust’s own synopsis is “Improper Origin Validation in an Internal Messaging Component.” The impact language is polite for “arbitrary upload of files,” which, on an appliance that brokers admin access to your entire Jump Item list, is how strangers become your helpdesk.

• CVE: CVE-2026-102764
• Advisory: BT26-05 (CVSSv4 9.3)
• Affected: Remote Support all versions <= 26.2.3
• Fix: BT26-05-RS patch for v24.3.1 through v26.2.3; older trains upgrade first
• SaaS: BeyondTrust applied the patch October 9, 2026
• KEV: added 2026-10-16, due 2026-10-19, forensic triage: Yes

ARMORY CASTLE did not wait for your change window

Mandiant says during incident response it found evidence ARMORY CASTLE exploited this as a zero-day in late August 2026. Post-exploitation was not “drop a random webshell and leave.” It was appliance-native: proprietary CLI abuse (/ns/sbin/bt-secrets vault dumps), startup template persistence via zz-root-persist under /home/bomgar/sbin/post_boot.d, SUID copies of /bin/sh as /usr/bin/dbus-authd, HAProxy ACL surgery for a WebSocket SOCKS path, and systematic deletion of auth, SSL, HTTP, PHP, and messages logs. That is not a script kiddie afternoon. That is someone who read the appliance like a product manager.

Public file IOCs from Mandiant include:

• mangoapi.php (SAWFLY webshell) SHA-256 dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb
• ingredi_ws (BARECLAW tunneler) SHA-256 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462
• Staging path pattern involving app_84304470%2Ephp

SAWFLY listens for an obfuscated POST parameter _c94mfe, Base32-decodes, RC4-decrypts, and @evals. Missing the parameter returns HTTP 404 so scanners see a ghost. BARECLAW is a CivetWeb-backed SOCKS5-over-WebSocket tunneler. In the observed case it listened on port 19800 with path /uidchanarge, token auth, XOR obfuscation, quiet mode, and HAProxy forwarding from the public edge to localhost so external scanners never see the listener.

Why this appliance is a delicious target

Remote Support exists to put privileged humans onto other people’s machines. Compromise the broker and you inherit the Jump Items, the vault, the API accounts, and the social cover of “IT support is in a session.” Mandiant observed Jump Item roles raised from No Access to Administrator, then file transfers of software inventories from desktops. Your board slide that says “privileged access management” just became the initial access condo.

GTIG notes ARMORY CASTLE has a habit of selective zero-day use followed by broad opportunistic scanning after disclosure. The Outlook section of their blog is not subtle: prepare for widespread exploitation attempts now that the CVE is public, the way you saw after Ivanti-era disclosures in prior years.

What to do tonight (self-hosted)

1. Inventory every Remote Support / Bomgar appliance. Record version. Confirm whether BT26-05-RS is present in /appliance.
2. Apply the patch (or upgrade then patch if older than 24.3.1). SaaS tenants: BeyondTrust says you are already patched for the vuln; credential review still applies.
3. Forward syslog off-box immediately if you were not already. On-appliance logs are a suggestion after root.
4. Hunt Mandiant’s paths, hashes, _c94mfe, /uidchanarge, zz-root-persist, unexpected dbus-authd, user_changed Jump Item escalations, and syslog forwarding gaps.
5. If exposure during the late-August-to-patch window is plausible: preserve (VM snapshot with memory if possible), isolate at the perimeter firewall rather than only inside the appliance UI, rebuild from known-good, rotate credentials in dependency order after the rebuild, redeploy Jump Clients and Jumpoints.
6. Federal and federal-adjacent: October 19 KEV due date under BOD 26-04. Forensic triage is marked Yes. Treat that as a requirement, not a blog comment.

Detection ideas that survive log deletion

• Reverse proxy / WAF URI logs for unknown .php paths and WebSocket upgrades outside support staff ranges
• Perimeter firewall: new outbound from the appliance to unfamiliar ASNs; inbound to weird paths
• SIEM: gaps in syslog forwarding bounded by a single session
• BeyondTrust syslog: user_changed raising Jump Item or team roles; odd API accounts; outbound event destination changes
• Endpoint: sessions started by accounts whose roles flipped during the window; file-transfer events from those sessions

Sloth take

We built a cathedral of “secure remote support” so an origin-validation bug in an internal messaging component could hand strangers file writes on the box that opens every other box. Mandiant watched a suspected state actor turn that into vault dumps, SUID shells, and a quiet SOCKS path behind HAProxy. Patch BT26-05-RS. Hunt SAWFLY and BARECLAW. Stop treating internet-facing support appliances like set-and-forget virtual furniture from a QBR slide.

Need a boring inventory of remote-support exposure without the marketing fog? Book a slot with Dark Edge Consulting.

Timeline (public facts only)

• Late August 2026: Mandiant IR finds ARMORY CASTLE exploiting the issue as a zero-day
• 2026-10-09: BeyondTrust patches all Remote Support SaaS tenants
• 2026-10-15: Public advisory BT26-05 / CVE-2026-102764; Mandiant blog on ARMORY CASTLE, SAWFLY, BARECLAW
• 2026-10-16: CISA KEV add plus dedicated CISA alert; due 2026-10-19

If your vulnerability SLA starts the clock when the intern forwards The Hacker News, you are already late relative to August’s zero-day window and October 9’s SaaS patch train.

Questions for BeyondTrust Support that do not sound lost

1. Is BT26-05-RS visible and applied on this appliance build?
2. What forensic preservation options exist for B Series vs virtual appliances, and can Support confirm compromise indicators?
3. Which cryptographic materials and credentials does BeyondTrust recommend rotating for our deployment type after a vulnerable exposure window?
4. Confirm the rebuild-from-scratch procedure and which pre-window config exports are safe to restore.

SaaS vs self-hosted: different flavors of homework

BeyondTrust says SaaS was patched October 9. That closes the vulnerability on the appliance BeyondTrust operates. It does not magically prove nobody abused your tenant before that date, and it does not rotate your vaulted credentials, API secrets, or Jump Client enrollments for you. Mandiant’s Option 3 credential and configuration review still applies. Self-hosted customers carry the full patch-and-forensics backpack. If /appliance does not show BT26-05-RS, open a case referencing BT26-05 instead of inventing a DIY hotfix from a forum thread.

Virtual appliances: snapshot with memory before you “just reboot to clear it.” Physical B Series: work with BeyondTrust Support for forensic preservation. Customers cannot casually audit the full host filesystem the way they audit a Linux VM they own, which is why Mandiant’s rebuild guidance exists. Cleaning a webshell you can see while missing zz-root-persist and a quiet HAProxy backend is how you reinstall the joke.

Credential rotation order that is not theater

Mandiant’s dependency order matters: appliance admin first, then /login admins and local users, API client secrets, security provider bind accounts and SAML signing keys, Remote Support Vault and integrated Password Safe / PRA credentials rotated at the target systems, then SMTP/syslog/ITSM/outbound event secrets, then anything typed into support sessions during the window. Rotate after patch or rebuild, not before, unless you enjoy gifting fresh secrets to whoever still owns the box.

Default Jump Item role in every group policy should be No Access, with grants through policy rather than per-user Christmas gifts. Require phishing-resistant MFA for /login. Keep one vaulted break-glass local account with alerting on use. Scope API accounts to the minimum and name an automation owner for anything that can manage users or Jump Items.

Network restrictions that survive marketing

• Internet should reach representative console, customer portal, and Jump Client traffic only where required
• /login and /appliance administrative interfaces restricted by IP or segment at the appliance and preferably also at the edge
• Reverse proxy or WAF with full URI logging in front so request paths survive on-box log deletion
• Default-deny egress from the appliance except BeyondTrust update/licensing endpoints and your own syslog and directory servers

Industry pattern recognition without the TED talk

Edge and remote-access appliances remain the preferred initial-access condo for espionage crews that can afford zero-days: Ivanti, Citrix, Fortinet, Palo Alto management planes, Cisco mail security, and now BeyondTrust Remote Support in the same autumn disaster calendar. The product category concentrates trust (credentials, sessions, downstream endpoints) behind a single internet-reachable personality. Origin validation bugs in internal messaging components are not a quirky edge case. They are the natural failure mode of “we talk to ourselves over privileged IPC and assume origin.”

Sources

• BeyondTrust Security Advisory BT26-05 / CVE-2026-102764 (Oct 15, 2026)
• Mandiant / Google Cloud Threat Intelligence, “ARMORY CASTLE Exploits BeyondTrust” (Oct 15, 2026)
• CISA alert: “CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support” (Oct 16, 2026)
• CISA KEV catalog entry CVE-2026-102764 (added 2026-10-16, due 2026-10-19)
• CISA: “CISA Adds Two Known Exploited Vulnerabilities to Catalog” (Oct 16, 2026)