BeyondTrust Remote Support Zero-Day Was Exploited From Late August, Before Any Patch

An unauthenticated remote attacker can perform file operations on a self-hosted BeyondTrust Remote Support appliance (version 26.2.3 or earlier, no credentials required) and reach host-level control, according to Google Threat Intelligence Group. The flaw is CVE-2026-102764, and Google's Mandiant team says a suspected China-linked espionage group exploited it as a zero-day from late August 2026.

The fix is patch BT26-05-RS. Operators should apply it first and rotate credentials second, because Mandiant warns that rotating while an attacker still controls the appliance hands over the new secrets as well.

What the flaw allows

Mandiant describes CVE-2026-102764 as an authentication bypass in Remote Support, the product formerly sold as Bomgar. Mandiant's summary says the bug "allows an unauthenticated remote attacker to perform file operations on the appliance, which can lead to host-level control and access to every credential the appliance stores or brokers."

The CISA alert calls the bug critical. It lists affected versions as 26.2.3 and earlier. Patches exist for supported versions, 24.3.1 and later, so customers on anything older must upgrade before they can apply BT26-05-RS.

BeyondTrust-hosted deployments were patched on October 9, 2026, according to Mandiant. Only self-hosted appliances need action from customers.

Timeline

Date	Event	Source
October 2023	Earliest known activity by the group Mandiant calls ARMORY CASTLE	Mandiant
Late August 2026	CVE-2026-102764 exploited as a zero-day	Mandiant
October 9, 2026	BT26-05 patch applied to all SaaS tenants	Mandiant
October 15, 2026	BeyondTrust discloses; Mandiant publishes	Mandiant
October 16, 2026	CISA adds the flaw to its Known Exploited Vulnerabilities catalog	CISA

The CISA catalog entry gives federal civilian agencies until October 19, 2026 to remediate. The alert page itself names no date and says only that affected organizations should act "immediately."

What the intruders did

The intrusion Mandiant analysed began with POST requests to a file named app_84304470%2Ephp, which the team could not recover. About 11 minutes after the first request, a webshell appeared. Mandiant calls it SAWFLY, an obfuscated PHP file named mangoapi.php that encrypts its command traffic with a 256-bit RC4 stream cipher.

From there the actor copied /bin/sh to /usr/bin/dbus-authd and set the SUID bit, leaving a root backdoor. It dumped the credential vault with the appliance's own bt-secrets utility and deleted the log of that run. A script called zz-root-persist added passwordless sudo for the site service account so the access would survive a reboot.

The actor then logged into the web admin portal with stolen Administrator credentials and raised a user's Jump Item and Team roles from "No Access" to "Administrator." Support sessions gave it a path to internal endpoints, where it pulled out documents such as software inventories. A tunneller Mandiant names BARECLAW, a SOCKS5-over-WebSocket tool, was exposed through an edited haproxy.conf.

Mandiant lists port 19800, the /uidchanarge WebSocket path and the _c94mfe parameter among its indicators. The SAWFLY hash is dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb.

What defenders should do

Mandiant's advice is blunt. Any appliance reachable from the internet on a vulnerable version during the exploitation window "should be treated as potentially compromised until it has been reviewed." Customers cannot audit the appliance file system, and the host-level persistence survives reboots and configuration resets, so the post recommends rebuilding rather than cleaning.

CISA adds the same steps in a different order: patch, restrict external access and administrative interfaces to trusted networks, then hunt for unrecognised privileged sessions and log gaps. If compromise is suspected, it says to rebuild from a known-good state, revoke every active support session and review new MFA registrations on privileged accounts.

This is the second edge appliance in a week where exploitation preceded the patch. The Ivanti Connect Secure zero-day entered the catalog on October 13, and the AhsayCBS pair followed on October 14.

What is not known

Mandiant names no victim organisations or sectors. It calls the attribution "suspected" and gives a high-confidence assessment only for a forward-looking claim: that ARMORY CASTLE, formerly tracked as UNC5221, will keep using edge-device zero-days for espionage. It also expects broad opportunistic exploitation now that the flaw is public.

BeyondTrust's own advisory, BT26-05, is linked from the CISA alert. This report relies on the CISA alert and Mandiant's analysis for technical detail. The CISA alert gives no CVSS score.

Federal agencies must remediate by October 19, 2026, per the catalog.