BeyondTrust Remote Support · Exploitation confirmed

BeyondTrust zero-day exploited since August; CISA urges patching

Aug 28, 2026 · 1 min read

CVE-2026-102764 in BeyondTrust Remote Support (formerly Bomgar) allows arbitrary file upload and was exploited as a zero-day since late August 2026 by ARMORY CASTLE, a suspected PRC-nexus espionage actor, according to Mandiant. CISA issued an alert on October 16 urging patch BT26-05-RS on self-hosted versions 24.3.1-26.2.3; older versions require an upgrade first. The SaaS offering was auto-patched on October 9.

By HIFY Radar newsroom Updated 10/26/2026 01:38 PM Get this every day →← Back to the feed 4 sources

CriticalVulnerabilityExploitation confirmedPartial fix

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A critical flaw in BeyondTrust Remote Support (formerly Bomgar), an enterprise remote access product used by IT teams, allows arbitrary file upload. Mandiant identified zero-day exploitation since late August 2026 by ARMORY CASTLE, a suspected China-linked espionage group. CISA issued an alert on October 16.

Why it matters

In intrusions responded to by Mandiant, the attacker gained full control of the appliance and access to every credential it stored or brokered, including passwords and keys, with persistence surviving reboot and configuration reset. Because the product grants privileged access across IT infrastructure, Mandiant warns of potential broad, opportunistic exploitation now that the flaw is public.

What to do

Apply patch BT26-05-RS immediately on self-hosted installations running 24.3.1-26.2.3; versions older than 24.3.1 require an upgrade first. Hunt for compromise in appliance logs, including the encrypted /home partition, and rotate credentials stored in the product.

For the technical team

CVE: CVE-2026-102764
Affected: BeyondTrust Remote Support (ex-Bomgar) · BeyondTrust Remote Support (formerly Bomgar), self-hosted, 26.2.3 and earlier. Versions older than 24.3.1 must upgrade before applying patch BT26-05-RS.
Exploitation: Zero-day exploitation since late August 2026 by ARMORY CASTLE (formerly UNC5221), a suspected PRC-nexus espionage actor, according to Mandiant, identified during an incident response engagement. CISA issued an alert on October 16, 2026. Mandiant warns of potential broad, opportunistic exploitation by ARMORY CASTLE and other actors following disclosure.
Fix: Patch BT26-05-RS for self-hosted installations 24.3.1-26.2.3. Versions older than 24.3.1 require an upgrade first. SaaS auto-patched on October 9.
Vector: CVE-2026-102764 in BeyondTrust Remote Support (formerly Bomgar) appliances: successful exploitation results in arbitrary file upload. Mandiant identified exploitation evidence within the access, syslog, messages, thin-scc, brain and SSL log files, accessible only via the LUKS-encrypted partition containing the /home directory.
More details: Post-exploitation chain described by Mandiant: SAWFLY webshell created about 11 minutes after the initial POST, with bidirectional encrypted C2 (256-bit RC4, custom Base32 transport) and HTTP 404 response when the _c94mfe parameter is absent, to evade scanners; execution via @eval. Root escalation via SUID binary. Credential vault extraction with the native bt-secrets utility, attempted with several syntaxes, followed by removal of bt-secrets.log. Persistence via zz-root-persist, which edits sudoers.template and forces a rebuild with /ns/sbin/bt-sysconfig, surviving reboot and configuration reset. The actor showed deep knowledge of appliance internals, including proprietary CLI utilities, and deleted logs and artifacts for anti-forensics. Root access exposed every credential the appliance stored or brokered.