BeyondTrust zero-day exploit lets hackers seize support appliances

The vulnerability is tracked as CVE-2026-102764 and carries a severity score of 9.3 out of 10, which is rated critical. BeyondTrust says internal components of Remote Support, the product once known as Bomgar, didn’t properly check where incoming messages came from. Under the right conditions, an attacker could use that gap to perform file operations on the appliance without logging in.

A zero-day is a flaw that attackers exploit before the vendor knows about it, so there is no patch to install. That was the case here. BeyondTrust’s own timeline says Armory Castle exploited the bug on a single self-hosted appliance on August 29. The company started hunting for similar activity after September 27, when a successful attack on another security vendor’s device became public.

The fix depends on how you run the software.

• SaaS (cloud) customers: BeyondTrust pushed the patch to every Remote Support SaaS customer by October 9. No action is needed to install it, though a security review is still wise.
• Self-hosted, versions 24.3.1 through 26.2.3: install the BT26-05-RS patch manually.
• Self-hosted, older than 24.3.1: upgrade to a supported version first, then apply the patch.

Google’s Mandiant researchers, who investigated the attacks, gave one blunt piece of advice. Any appliance reachable from the internet on a vulnerable version during the attack window should be treated as possibly compromised until someone has reviewed it. Patching closes the hole, but it doesn’t remove an intruder who is already inside.

Armory Castle was previously tracked as UNC5221 and Warp Panda. It has been active since October 2023 and has a record of exploiting zero-days in Citrix NetScaler and Ivanti Connect Secure appliances. Its targets have included governments, legal firms, technology and SaaS companies, and business-process outsourcers, and its goal is long-term intelligence gathering.

BeyondTrust says the group uses a zero-day carefully against chosen targets, then switches to mass exploitation of every unpatched system once the flaw is public. The company also believes the group plans ahead, keeping a working model of target products in an AI tool that it uses to build attack chains.

Mandiant described what happened after the break-in in broad strokes:

• The attackers planted a small web shell, a hidden program that gave them remote control, which Mandiant calls SAWFLY.
• They gained full administrator and root control of the appliance and set up access that survived reboots.
• They tried to pull passwords, API keys and endpoint credentials from the appliance’s built-in secrets store.
• Using stolen admin logins, they opened remote sessions to internal machines listed in the appliance and downloaded sensitive documents.
• They routed traffic through the device with a custom proxy tool called BARECLAW and deleted logs to slow investigators down.

To hide their origin, the operators connected through commercial VPN services and hacked home and small-office routers, so their traffic looked ordinary.

CISA published an advisory on October 16 urging anyone running an affected version to act. Its checklist, in plain terms:

1. Apply the BT26-05-RS patch, or upgrade and then patch.
2. Cut external access to the appliance down to only the services you actually need.
3. Run network and memory forensics to look for evidence of a break-in.
4. Isolate any appliance you suspect was hit, look for unrecognized admin or privileged sessions, and take a snapshot of virtual appliances for investigators.

Sensible extras include rotating every credential stored in the appliance, checking the logs of systems it connects to (since local logs may have been wiped), and requiring multi-factor sign-in for admin accounts.

CISA describes the attack in four stages: the attackers get in through the flaw, settle in, raise their privileges and then spread across the network. Each stage leaves clues that defenders can look for.

• Missing logs. Gaps in system, web server or application logs on the appliance are a red flag, because this group wipes them.
• Admin sessions nobody recognizes. Remote sessions to internal machines that no one on the IT team started deserve a close look.
• Changed settings. The attackers edited the appliance’s web traffic settings so their proxy tool could be reached straight from the internet.
• Odd connections. Logins arriving from commercial VPN services or home internet connections, rather than your usual office or provider addresses.

If any of these show up, treat the appliance as compromised. Keep a copy for investigators, rebuild it on a patched version, and assume every password it held has been stolen.

Most people will never touch BeyondTrust. But your employer, your bank, a law firm or a government office you deal with may use it to support staff computers. When an attacker controls the tool that manages those machines, the documents and logins on them are exposed too.

If you run a small business that relies on an outside IT company, ask them directly whether they use BeyondTrust Remote Support, whether it is patched, and whether they’ve reviewed it for signs of intrusion. If you’re an employee, watch for unexpected remote sessions or password reset requests, and report them to your IT team instead of approving them.

Armory Castle also has a habit of returning to unpatched systems once a flaw is public. Slow patching is how a targeted attack turns into a broad one.