CVE-2026-102764

What is BeyondTrust Remote Support?

BeyondTrust Remote Support (formerly Bomgar) is an enterprise remote assistance platform. Help desk and IT operations staff use it to open attended and unattended sessions on employee workstations, servers, and network gear, transfer files, and run privileged commands. It is normally deployed as a hardened appliance, either self-hosted or in BeyondTrust's SaaS, and it is deliberately reachable from the internet so technicians and remote endpoints can connect.

That design makes it an unusually valuable target. The appliance brokers credentials for downstream systems, stores secrets in a local vault, and already holds legitimate remote-control access to large parts of the estate. An attacker who owns the appliance inherits that access without having to break anything else.

Overview

CVE-2026-102764 is a critical authentication bypass in Remote Support that lets an unauthenticated, remote attacker perform file operations on the appliance, including writing files into the web root. BeyondTrust rates it 9.3 on CVSS v4.0; the CVSS v3.1 vector carried in the KEV entry scores 9.8. No user interaction, no credentials, and no prior foothold are required.

The flaw was exploited as a zero-day well before anyone knew it existed. BeyondTrust's own threat hunting identified suspicious activity on 2026-09-28 and reproduced the vulnerability the same day, but telemetry later placed the earliest exploitation on 2026-08-29, against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. Google Threat Intelligence Group and Mandiant investigated and attributed the campaign to ARMORY CASTLE, a suspected PRC-nexus espionage actor previously tracked as UNC5221 and called WARP PANDA by CrowdStrike.

BeyondTrust shipped the BT26-05 patch on 2026-10-08, completed patching of all Remote Support SaaS tenants by 2026-10-09, and disclosed publicly on 2026-10-15. CISA added the CVE to the KEV catalog the next day with an unusually short three-day remediation deadline of 2026-10-19. GTIG expects broad opportunistic exploitation now that the flaw is public, following the pattern of the 2024 Ivanti Connect Secure campaigns.

Affected Versions

Note that the fix is a patch, not a version bump: there is no Remote Support 26.2.4 to upgrade to.

Technical Details

BeyondTrust classifies the issue as CWE-290, authentication bypass by spoofing. In plain terms, an internal messaging component on the appliance accepted messages without properly verifying where they came from. Code that was only ever meant to be driven by trusted local components could therefore be driven by an outside caller, and the file-handling operations exposed through that path became reachable pre-authentication. Mandiant describes the practical effect as unauthenticated arbitrary file upload. VulDB files it under CWE-345 (insufficient verification of data authenticity) instead, which is a reasonable alternative reading of the same root cause. BeyondTrust is deliberately withholding lower-level detail.

Attack characteristics are about as bad as they get: network reachable, low complexity, no authentication, no user interaction, and a single HTTP request is enough to stage a payload. In the observed intrusions the actor sent POST requests to /app_84304470%2Ephp and roughly eleven minutes later wrote a webshell into the Laravel public directory under the site service account.

Discovery

The vulnerability was found through incident response rather than proactive research. BeyondTrust's internal threat hunting team detected anomalous activity on 2026-09-28 and reproduced the underlying flaw that day. Mandiant and Google Threat Intelligence Group identified and analysed the initial intrusions and published the technical attribution; BeyondTrust issued the advisory and CVE. No independent researcher is credited, and there is no public proof-of-concept at the time of writing.

Exploitation Context

Exploitation is confirmed and pre-dates disclosure by roughly six weeks. ARMORY CASTLE used the flaw to deploy SAWFLY, an obfuscated PHP webshell dropped as mangoapi.php that uses a custom Base32 transport with RC4 encryption and returns HTTP 404 unless the POST parameter _c94mfe is present, which hides it from scanners. The actor escalated from the unprivileged site service account to root by copying /bin/sh to /usr/bin/dbus-authd, setting it root-owned and SUID.

From root they dumped the credential vault with the appliance's own /ns/sbin/bt-secrets CLI, established persistence through a boot script at /home/bomgar/sbin/post_boot.d/zz-root-persist that appends a passwordless sudo rule to the sudoers template so it survives reboots and config resets, and deployed BARECLAW (ingredi_ws), a C-based SOCKS5-over-WebSocket tunneler listening on localhost port 19800 and exposed through a modified HAProxy config at the path /uidchanarge. They then deleted appliance logs, raised a compromised Administrator account's Jump Item and Team roles from No Access to Administrator, and used legitimate remote support sessions to reach downstream systems and exfiltrate files.

Shadowserver tracks more than 1,400 internet-exposed BeyondTrust Remote Support instances. No ransomware use has been reported; this is espionage activity.

Remediation

1. Apply BT26-05-RS from the /appliance interface on all self-hosted Remote Support appliances running 24.3.1 through 26.2.3. Installations older than 24.3.1 must first upgrade to a supported release. Self-hosted customers not subscribed to automatic updates must do this manually.
2. Apply the precautionary BT26-05 patch to self-hosted Privileged Remote Access, which shares the affected code. SaaS tenants were patched on 2026-10-09 and need no action.
3. Treat any internet-reachable appliance that ran a vulnerable version between 2026-08-29 and the date you patched as potentially compromised. Patching does not evict an attacker who is already resident.
4. Preserve evidence before rebooting or rebuilding: capture memory, disk, and snapshots, and pull syslog, WAF, proxy, and firewall logs from off-appliance sources, since the actor deletes on-appliance logs.
5. Hunt for the known indicators: mangoapi.php, ingredi_ws, the SUID binary /usr/bin/dbus-authd, the boot script zz-root-persist, passwordless sudo entries in /ns/config/sudoers.template, HAProxy backends routing /uidchanarge, requests to unfamiliar .php paths, user_changed events raising Jump Item or Team roles to Administrator, unexplained gaps in forwarded syslog, and unexpected file-transfer events in support sessions.
6. If compromise is confirmed or cannot be ruled out, isolate the appliance and rebuild from a clean, patched image, restoring only a configuration backup dated before the exposure window. Do not attempt to clean in place.
7. Rotate privileged credentials, especially anything held in the appliance vault or brokered to downstream systems, only after the appliance is patched, isolated, or rebuilt, and work in dependency order.
8. Harden going forward: restrict network access to the /login and /appliance interfaces, require SAML SSO with phishing-resistant MFA, set the default Jump Item role to No Access, and forward all appliance logs to an external SIEM.
9. Federal civilian agencies had until 2026-10-19 to remediate under BOD 22-01. Given confirmed nation-state exploitation and a three-day deadline, all organisations should treat this as an emergency change.