A critical vulnerability in BeyondTrust Remote Support, CVE-2026-102764, is being exploited in the wild. An attacker needs no account at all, only network reach to the appliance, and can then carry out file operations on it. Attackers used the flaw as a zero-day from late August 2026, CISA added it to the Known Exploited Vulnerabilities catalogue on 16 October 2026, and the vendor has released a patch.
What happened
BeyondTrust Remote Support (formerly Bomgar) is a remote support appliance. Helpdesk staff use it to connect to computers and servers inside the organisation, so the appliance is usually reachable from the internet while also holding a path into the internal network and stored credentials.
According to BeyondTrust advisory BT26-05 of 15 October 2026, an internal component of the product did not adequately validate where a message came from (CWE-290, authentication bypass by spoofing). An attacker can use that for unauthorised file operations on the appliance, in practice to upload a file of their own and move further inside. The vendor rates the flaw as critical with a CVSS 4.0 score of 9.3 and confirms that exploitation requires neither authentication nor any user interaction.
BeyondTrust describes how an attacker exploited the flaw on 29 August 2026 against one vendor-hosted instance and one customer-hosted appliance. Its own team found the activity on 28 September 2026 and contained the hosted instance within 27 minutes. Mandiant also investigated and attributes the activity to the espionage group ARMORY CASTLE (previously tracked as UNC5221), describing malware named SAWFLY and BARECLAW. Mandiant also warns that once a fix becomes public, flaws like this one tend to be exploited broadly against every unpatched appliance.
What makes it worse is that the patch alone does not evict the attacker. Anyone who got into the appliance earlier has their own access to it, and the fix does not remove that.
Does this affect you?
Remote Support versions 26.2.3 and earlier are affected. The Privileged Remote Access product shares the same code, the vendor found no exploitable path in it, yet released a patch for it as well and recommends applying it.
If you use Remote Support or Privileged Remote Access as a service from BeyondTrust, the vendor patched it for you, Remote Support instances on 8 October and Privileged Remote Access on 9 October 2026. If you run the appliance yourself and do not have automatic installation of critical updates enabled, you have to apply the patch manually.
You can check the version in the appliance administration at /appliance. If you are unsure whether you have such an appliance, look for the tool your helpdesk or an external supplier uses to connect to user workstations.
What to do now
- Apply the BT26-05-RS patch from the appliance administration (/appliance). It covers versions 24.3.1 through 26.2.3.
- If you run a version below 24.3.1, upgrade to a supported version first and then apply the patch.
- For Privileged Remote Access, apply the corresponding BT26-05-PRA patch.
- If the appliance was reachable from the internet from late August 2026 onwards and ran a vulnerable version, treat it as possibly compromised. Mandiant recommends applying the patch, then rebuilding the appliance from a clean, fully patched image, and only afterwards rotating credentials.
- Do not reboot the appliance before you preserve its state. Take a snapshot first.
- Restrict access to the appliance from the internet to the addresses you actually connect from.
- US federal agencies have a remediation deadline of 19 October 2026 under the CISA KEV catalogue. That deadline does not apply to private organisations, but it shows how CISA rates the risk.
How to tell whether you are already compromised
Mandiant published what the attacker did on the appliance. Based on that description, review the following in particular:
- Calls to the credential vault dump utility (/ns/sbin/bt-secrets) in command logs.
- Changes to the HAProxy configuration, which the attacker used to expose a SOCKS5 tunnel through the legitimate HTTPS front end of the appliance, keeping it invisible to ordinary external port scanning.
- Jump Item and Team permissions raised from No Access to Administrator, new users and new API accounts, and administrator logins nobody on the team recognises.
- File transfers that belong to no reported support case, and changes to where the appliance sends its logs.
- Log deletion itself: the attacker removed authentication records, web server records and vault access records. An unexplained gap in forwarded syslog during a single session is a strong signal that logs were tampered with.
Organisations that find evidence of exploitation should, per the vendor, open a Severity 1 support request referencing BT26-05. If you are handling an incident right now, reach us on our incident response page.
Not enough time to track this?
Most organisations do not have the people to follow vendor advisories for every appliance on the network edge. We help with that in two ways: a security assessment shows what you have exposed to the internet and where you stand on vulnerabilities, and as your external security manager we keep track of priorities and remediation over time. The first consultation is free of charge, get in touch.
Sources: BeyondTrust, advisory BT26-05 on CVE-2026-102764 · CISA, urging patching of BeyondTrust Remote Support · CISA, Known Exploited Vulnerabilities catalogue · Mandiant and Google Threat Intelligence, analysis of the ARMORY CASTLE campaign · NVD, CVE-2026-102764 record · BleepingComputer, summary of exploitation since August 2026