critical severityConfidence highHistorical record

BeyondTrust Remote Support zero-day lets attackers plant a web shell without logging in, on CISA KEV (CVE-2026-102764)

CVE-2026-102764 is an improper origin validation flaw in an internal messaging component of BeyondTrust Remote Support (CWE-290) that lets an unauthenticated remote attacker perform file operations on the appliance. Mandiant reports the suspected PRC-nexus actor ARMORY CASTLE (formerly UNC5221) exploited it as a zero-day from late August 2026, planting the SAWFLY web shell, escalating to root via a SUID shell copy, adding reboot-persistent sudoers changes, attempting to dump the appliance credential vault with bt-secrets, tunneling through a HAProxy route, and deleting logs. BeyondTrust patched SaaS by 2026-10-09 and disclosed on 2026-10-15. CISA added it to KEV on 2026-10-16.

Also tracked as CVE-2026-102764 · BT26-05 · BeyondTrust Remote Support zero-day · Bomgar file upload · ARMORY CASTLE BeyondTrust

First observed
Aug 29, 2026
Last observed
Sep 28, 2026
Last reviewed
Oct 16, 2026
Tracking ended
Sep 28, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

BeyondTrust is withholding technical details of the entry point and reports two affected customers as of 2026-10-16; Mandiant warns of broad exploitation after disclosure. Privileged Remote Access shares the code but BeyondTrust found no way to exploit it.

  • SaaS tenants patched by 2026-10-09; credential review still applies if exposed earlier
  • Privileged Remote Access shares the code but BeyondTrust found no exploitation path; patch released as a precaution
  • Flaw is on the appliance, not in Jump Clients or the representative console
  • Patching does not evict an attacker who already established persistence

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

No Guard coverage mapping is published for this record.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. First observed

    Mandiant reports ARMORY CASTLE exploited the flaw as a zero-day in late August 2026.

  2. Vendor action

    BeyondTrust has applied the BT26-05 patch to all Remote Support SaaS tenants; self-hosted customers apply BT26-05-RS from /appliance.

  3. Disclosure

    Coordinated disclosure: CVE-2026-102764 published alongside advisory BT26-05 and Mandiant analysis.

  4. Update

    CISA adds CVE-2026-102764 to KEV (catalog 2026.10.16), federal due date 2026-10-19, forensic triage required.

Publication clock: 21.4 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; historical backfill outside target.

Indicators

Published values are defanged so nothing here is copy-paste executable. These are inert text, never links.

2 indicators are recorded as not defanged. Treat them as live.

  • file hashhigh confidencenot defanged
    dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb
  • file hashhigh confidencenot defanged
    1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462

Sources

Every claim on this record is traceable to the sources below.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-B46D01FA