BeyondTrust Remote Support CVE‑2026‑102764 Exploited: BT26‑05 Patch and IOCs

• Affected: BeyondTrust Remote Support, formerly Bomgar, up to and including 26.2.3. The weakness is authentication bypass by spoofing, CWE-290: internal components did not validate where the messages they received came from.
• Patch: BT26-05-RS for self-hosted versions 24.3.1 and later; older versions must first upgrade to a supported version. BeyondTrust patched all SaaS tenants on October 9, 2026.
• Exploitation: BeyondTrust disclosed the flaw on October 15, and CISA added it to the Known Exploited Vulnerabilities catalog on October 16. CISA's SSVC assessment rates exploitation as active.
• Mandiant expects broad exploitation after disclosure, because ARMORY CASTLE has historically moved from selective zero-day use to opportunistic attacks once a flaw becomes public, as it did in 2024 after CVE-2023-46805 and CVE-2024-21887 were disclosed.

How ARMORY CASTLE Took Over Remote Support Appliances #

The Mandiant report describes one intrusion step by step. After the exploit, the attacker sent POST requests to /app_84304470%2Ephp, and about 11 minutes later the SAWFLY webshell, mangoapi.php, appeared under /%SITE_SERVICE_ACCOUNT%/ingredi/app/laravel/public/. SAWFLY answers with a 404 unless a POST carries the parameter _c94mfe, and then runs RC4-encrypted PHP code.

To reach root, the attacker copied /bin/sh to /usr/bin/dbus-authd, gave it to root and set the SUID bit. For persistence, a script named zz-root-persist in /home/bomgar/sbin/post_boot.d adds %SITE_SERVICE_ACCOUNT% ALL=(ALL) NOPASSWD: ALL to /ns/config/sudoers.template and rebuilds /etc/sudoers with bt-sysconfig, so the change survives reboots and configuration resets. The attacker used the appliance's own /ns/sbin/bt-secrets tool to try to dump the credential vault, then deleted /home/bomgar/log/bt-secrets.log.

Inside Remote Support, the attacker logged in with a compromised Administrator account and raised its Jump Item and Team roles from No Access to Administrator, which allowed remote sessions to every downstream system in the Jump Item list. The BARECLAW tunneler, a SOCKS5 proxy over WebSocket, ran as /tmp/ingredi_ws --listen 19800 with the path /uidchanarge, and edits to /ns/config/haproxy.conf routed that path from the internet to it. The attacker also deleted logs under /ns/log and /var/log/messages.

Indicators Teams Can Hunt For #

• Files: mangoapi.php (SHA-256 dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb), /tmp/ingredi_ws (SHA-256 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462), a SUID root /usr/bin/dbus-authd, and /home/bomgar/sbin/post_boot.d/zz-root-persist.
• Configuration: a NOPASSWD: ALL line for the site account in /ns/config/sudoers.template, and an ACL named wswsws with a backend webskd3 pointing to 127.0.0.1:19800 in haproxy.conf.
• Requests: /app_84304470%2Ephp, /uidchanarge, unknown .php paths and WebSocket upgrades from outside support staff address ranges, as seen at a reverse proxy or WAF.
• Syslog: user_changed events that raise a Jump Item or team role to Administrator, new API accounts or security providers without a change ticket, and gaps in syslog forwarding.
• Mandiant publishes YARA rules for SAWFLY and BARECLAW in its report. It found the exploitation evidence in the access, syslog, messages, thin-scc, brain and SSL logs, which sit on a LUKS-encrypted partition holding /home.

What Self-Hosted Remote Support Owners Should Do Now #

Both CISA and Mandiant put the patch first and then the hunt. On version 24.3.1 or later, apply BT26-05-RS from the /appliance interface, or confirm it was applied automatically if the appliance subscribes to automatic updates. Mandiant notes that upgrading closes the vulnerability but does not undo earlier compromise.

Where compromise is suspected, Mandiant advises preserving evidence before any change: snapshot virtual appliances with memory, collect syslog, reverse-proxy, WAF and firewall logs for the whole exposure window, block inbound traffic at the perimeter rather than in /appliance, and rebuild from a clean, patched image instead of cleaning, since host-level persistence survives a reboot. Credentials should be rotated only after patching or rebuilding, in order: /appliance administrators, /login users, API secrets, security provider bind accounts and SAML signing keys, vault and Password Safe credentials, integration credentials, and anything typed into a support session during the window. CISA adds a review of new multifactor authentication registrations on privileged accounts.

Why the Exposure Window Starts in August, Not October #

Because the exploitation began in late August and disclosure came on October 15, logs for a review need to reach back at least to August. The attacker deleted on-appliance logs, so the log copies outside the appliance, in the SIEM, reverse proxy or firewall, are the reliable record. SaaS tenants were patched on October 9, but Mandiant still applies its credential and configuration review to them.