What happened

On October 15, 2026, BeyondTrust disclosed CVE-2026-102764 in security advisory BT26-05. According to the CVE record, internal components of Remote Support "did not adequately validate the origin of the messages it received," which "could allow an attacker to perform file operations on the appliance." BeyondTrust scores it CVSS v4.0 9.3, and NVD scores it CVSS 3.1 9.8: network reachable, no authentication, no user interaction. The fix is the BT26-05-RS patch for versions 24.3.1 through 26.2.3; older versions must upgrade first. BeyondTrust patched its SaaS customers before disclosure (October 8 or 9, depending on the report). Privileged Remote Access shares the affected code, and BeyondTrust released a patch for it "out of an abundance of caution," though its testing found no way to exploit it there.

The flaw was already in use. Google's Mandiant says ARMORY CASTLE, "a suspected PRC-nexus espionage threat actor (formerly tracked as UNC5221), exploited this vulnerability as a zero-day, in late August 2026." BeyondTrust's timeline, as reported by Rapid7, has two compromises on August 29: one BeyondTrust-hosted instance and one self-hosted appliance. CrowdStrike tracks the same group as Warp Panda, BleepingComputer reported. On the appliance, the attackers uploaded a PHP webshell (SAWFLY), gave themselves root by planting a SUID copy of the shell, dumped the credential vault with bt-secrets, added a persistence script, and set up a SOCKS5 tunnel (BARECLAW) behind an edited HAProxy configuration. They also wiped logs and abused admin sessions to pull files from endpoints. CISA added the CVE to the KEV catalog on October 16 and issued a separate alert urging patching. Shadowserver tracks over 1,400 Remote Support instances exposed online, per BleepingComputer. No verified public proof of concept has been reported, and Mandiant expects "similar widespread exploitation attempts."

Why it matters if you run public infrastructure

Remote support tools sit on the internet so technicians can reach customers and staff, and they hold the keys to do it: stored credentials, injected passwords and live sessions into endpoints. That makes them one of the most valuable things an attacker can take over. This is the fourth exploited Remote Support flaw on CISA's KEV catalog since December 2024, after CVE-2024-12356, CVE-2024-12686 and CVE-2026-1731. Because the attacks began weeks before the patch, and the evidence sits in logs customers cannot read without BeyondTrust's help, applying the patch today says nothing about what happened in September.

What to check this week

  1. Find every Remote Support and Privileged Remote Access appliance you run, including old ones kept for a migration, and confirm which are reachable from the internet.
  2. Preserve evidence, then patch. watchTowr warns that "patching can overwrite evidence." Mandiant found its evidence in access, syslog and appliance logs on an encrypted partition that needs BeyondTrust Support to read, so open a case with them first if the appliance was exposed. Then apply BT26-05-RS (or upgrade to 24.3.1 or later and apply it).
  3. Treat exposed appliances as possibly compromised. Mandiant: "Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised." Look for POST requests to unusual .php paths, a mangoapi.php file in the Laravel public folder, unexpected HAProxy changes, listeners on port 19800, and a /usr/bin/dbus-authd binary.
  4. Rebuild and rotate. CISA's guidance for a compromised appliance is to rebuild from a known-good state, apply the patch, then rotate every credential the appliance stored or injected and revoke all active support sessions. Rotate after the rebuild, not before.
  5. Limit exposure. CISA advises restricting external access and keeping admin interfaces on trusted networks.

How Attack Surface Scan covers this

Attack Surface Scan does not identify BeyondTrust Remote Support specifically and will not raise a CVE finding for this flaw. What it does show is the inventory: the hosts under your verified domains, including ones found through certificate transparency logs, with their open ports, web services and TLS certificates. A remote support appliance usually has its own hostname and certificate, which is how a forgotten one turns up. We do not send exploit traffic. See Vulnerability matching for which products we match CVEs against.

Sources