ALERT · Actively exploited. Last updated 28 October 2026. See the Alert Tracker
Companion hunt: Hunt: BeyondTrust ARMORY CASTLE SAWFLY / BARECLAW.
If you run self-hosted BeyondTrust Remote Support (formerly Bomgar) at 26.2.3 or earlier, treat CVE-2026-102764 as urgent. SaaS tenants were patched by BeyondTrust; self-hosted estates still need BT26-05-RS.
What it is
CVE-2026-102764 (opens in a new tab) is an authentication-bypass-by-spoofing flaw (CWE-290) that lets a remote, unauthenticated attacker perform file operations on the appliance. NVD lists CVSS 4.0 9.3 Critical. Mandiant documents post-exploit SAWFLY (PHP webshell) and BARECLAW (SOCKS5/WebSocket tunneler), vault dump via bt-secrets, Jump Item role elevation, and local log deletion.
Who is affected
BeyondTrust Remote Support versions 26.2.3 and prior. Patch BT26-05-RS applies to supported builds 24.3.1 through 26.2.3; older self-hosted installs must upgrade first. BeyondTrust also shipped the patch for Privileged Remote Access out of caution. BeyondTrust-hosted (SaaS) Remote Support and PRA were auto-patched around 8–9 October 2026.
Exploitation status
CISA added the CVE to KEV on 16 October 2026 (federal agencies: KEV remediation overdue since 19 October; ransomware Unknown; forensic triage Yes). Mandiant attributes zero-day use from late August 2026 to ARMORY CASTLE (formerly UNC5221; CrowdStrike: WARP PANDA) and warns of broader opportunistic exploitation after disclosure. FIRST EPSS (27 October): about 0.190 (97th percentile).
Fix and mitigation
Apply BT26-05-RS from /appliance (or upgrade then patch if below 24.3.1). Restrict internet reach to /login and /appliance; forward syslog and session events off-box — local logs are wiped in observed intrusions. If compromise is plausible: isolate, image, rebuild from a known-good patched image, then rotate every credential the appliance stored or injected and review Jump Item / Teams role changes.
How to hunt
Hunt unknown .php under the web root (incl. SAWFLY mangoapi.php), HAProxy path anomalies (e.g. custom WebSocket paths), user_changed events raising Jump Item roles to Administrator, syslog gaps bounded by a single session, and Mandiant’s SAWFLY/BARECLAW YARA. Draft notes: hunts/ in this pack.
Sources
- CISA — BeyondTrust Remote Support CVE-2026-102764 (opens in a new tab) (16 October 2026)
- BeyondTrust — ARMORY CASTLE and BT26-05 (opens in a new tab)
- Mandiant / GTIG — ARMORY CASTLE Exploits BeyondTrust (opens in a new tab) (15 October 2026)
- CCCS AL26-025 (opens in a new tab)
- CISA KEV (opens in a new tab) (dateAdded 2026-10-16, dueDate 2026-10-19 — overdue for federal agencies)
- NVD CVE-2026-102764 (opens in a new tab)
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)