BeyondTrust Remote Support Zero-Day: What to Check

Field notes from the engineering team

On October 15, 2026, BeyondTrust disclosed a critical flaw in Remote Support, the product formerly known as Bomgar. IT teams and IT providers use it to connect to staff computers and servers and fix problems from a distance. A suspected China-linked espionage group had been exploiting the flaw since late August, weeks before the public disclosure.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog the next day. Mandiant has warned that wider exploitation may follow now that the flaw is public.

If your organization, or the company that supports your IT, runs a self-hosted BeyondTrust Remote Support appliance, this is a same-day item. If neither does, it is still a useful look at how attackers go after the tools that IT staff trust most.

The short version

Item	Detail
CVE	CVE-2026-102764 (BeyondTrust advisory BT26-05)
Severity	Critical, CVSS v4.0 9.3
What it is	Improper origin validation in an internal messaging component. A remote, unauthenticated attacker can perform file operations on the appliance. In the observed attacks, that meant uploading files.
Affected	BeyondTrust Remote Support, version 26.2.3 and earlier. Privileged Remote Access shares the affected code. BeyondTrust found no way to exploit it there, but released the patch for it anyway.
Fix	Patch BT26-05-RS for versions 24.3.1 through 26.2.3. Older versions must upgrade first, then patch.
Cloud-hosted (SaaS)	Already patched by BeyondTrust. No action needed.
Exploitation	Zero-day since August 29, 2026. In CISA’s KEV catalog since October 16.
Actor	ARMORY CASTLE, tracked earlier as UNC5221 (CrowdStrike: WARP PANDA), a suspected PRC-nexus espionage group

Why a remote support appliance is a prize

A remote support appliance sits in a powerful spot. It can open sessions on many computers, transfer files to and from them, and it stores credentials for the systems it manages. Whoever controls it can see who connects to what, and can often connect there too.

That is why this actor goes after it. BeyondTrust’s write-up says the group prefers edge and remote-access appliances for initial access. Mandiant has previously tied the same cluster to zero-days in Citrix NetScaler and Ivanti Connect Secure. BeyondTrust lists the group’s documented targets as legal services, SaaS providers, business-process outsourcers, technology companies, and government.

Law firms, government offices, and technology companies are common among small and mid-sized organizations in northern Utah and southern Idaho. Some run a tool like this in-house. Others rely on an IT provider that runs one for them.

What the attackers did

Mandiant’s incident-response write-up describes the intrusion on a compromised appliance:

1. Entry. The attackers exploited CVE-2026-102764 to upload files to the appliance without logging in.
2. Web shell. About 11 minutes after the first request, a web shell Mandiant calls SAWFLY appeared in the appliance’s web directory. It gave them remote command execution.
3. Root access. They copied the system shell to a new file, /usr/bin/dbus-authd, made it owned by root, and set the SUID bit. That created a persistent root backdoor.
4. Credential theft. They tried to dump the appliance’s stored secrets with its own bt-secrets utility, then deleted that utility’s logs.
5. Persistence. A startup script gave the appliance’s service account passwordless root access, written in a way that survives reboots and configuration resets.
6. Tunneling. A custom proxy tool Mandiant calls BARECLAW relayed traffic through the appliance.
7. Lateral movement. Using stolen administrator credentials, they logged in to the web admin portal and raised the account’s Jump Item and Team permissions from “No Access” to “Administrator.” That allowed them to start sessions on downstream machines.
8. Reconnaissance. They used the built-in file transfer feature to pull documents such as software inventories from a user’s desktop.
9. Cleanup. They deleted logs across the appliance throughout.

BeyondTrust says the exploitation hit one BeyondTrust-hosted instance and one self-hosted appliance on August 29. Its own threat hunting found the hosted instance on September 28, and it released the patch on October 8. As of its last update, it knew of only those two affected customers and had seen no attacker activity since August. Nobody knows yet whether more victims will turn up now that the flaw is public.

BeyondTrust’s own sensors did fire when the attacker escalated privileges. An automated triage tool in a third-party detection product then closed those alerts as false positives. BeyondTrust is changing that setting so high-severity signals cannot be closed automatically. If you rely on automated alert triage, check what your tools are allowed to close without a person looking at it.

What to do

1. Find out whether you have it. Ask your IT team or provider directly: “Do we run a self-hosted BeyondTrust Remote Support or Privileged Remote Access appliance?” If the answer is a cloud-hosted subscription, BeyondTrust has already patched it.

2. Patch self-hosted appliances now. Apply BT26-05-RS as described in advisory BT26-05. If the appliance is older than 24.3.1, upgrade first, then patch. Do not wait for a maintenance window.

3. Shrink what the internet can reach. CISA recommends limiting external access to the appliance to the services users and customers actually need, and restricting administrative interfaces to trusted networks. BeyondTrust also recommends allowing outbound traffic from the appliance only to the destinations it needs.

4. Get the logs off the box. This actor deletes local logs. Forward appliance syslog and session events to a separate system in near real time. Off-box copies may be the only record left.

5. Hunt, because patching does not evict someone already inside. CISA and BeyondTrust point to these signs:

• Privileged or administrative sessions you cannot tie to a known administrator or a ticket, especially from residential broadband or commercial VPN addresses.
• Script files you do not recognize in web directories, or web service accounts launching shells.
• Account, permission, or session-policy changes you did not make, particularly to Jump Item or Team permissions.
• Gaps in log forwarding that start and end inside a single session.

Mandiant has published file hashes and YARA rules for SAWFLY and BARECLAW in its write-up. Indicators from one victim rarely repeat at the next, because the actor rotates infrastructure and tools, so look for behavior as well as hashes.

6. If you find anything, treat the appliance as compromised. CISA’s guidance is to isolate it, take a snapshot or forensic image first, rebuild from a known-good state, and apply the patch. Then rotate every credential the appliance stored or injected, revoke all active support sessions, and review new multifactor registrations on privileged accounts. BeyondTrust asks customers who see signs of exploitation to open a Severity 1 support request citing “BT26-05.”

What this looks like from a monitored environment

An appliance like this is hard to watch from the inside, because the attacker can edit the logs you would read. The defenses that work are the plain ones from the list above: know what you run, patch it fast, keep it off the open internet where you can, and keep a second copy of its logs somewhere the attacker cannot reach.

Our managed SOC and remote monitoring are built around that kind of off-box visibility, including the systems behind the appliance, where an attacker with stolen remote-support access ends up. If a suspected compromise turns up, our incident response team handles the isolation, imaging, and credential reset. Limiting who and what can reach admin tools in the first place is the idea behind zero trust access.

For law firms in particular, a stolen remote-access credential is a client-confidentiality problem as well as an IT one. We covered another fast-moving case this week in PHP2Shell: Two Critical PHP Flaws and What to Do Now.

If you are not sure whether your organization or your IT provider runs this product, ask us and we will help you find out.

Sources

• BeyondTrust Security Advisory BT26-05
• BeyondTrust: ARMORY CASTLE and BT26-05: What Security Teams Need to Know
• Mandiant / Google Threat Intelligence Group: ARMORY CASTLE Exploits BeyondTrust
• CISA: CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
• CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-102764
• NIST NVD: CVE-2026-102764