{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-B46D01FA",
  "slug": "cve-2026-102764-beyondtrust-remote-support-file-upload-kev",
  "title": "BeyondTrust Remote Support zero-day lets attackers plant a web shell without logging in, on CISA KEV (CVE-2026-102764)",
  "aliases": [
    "CVE-2026-102764",
    "BT26-05",
    "BeyondTrust Remote Support zero-day",
    "Bomgar file upload",
    "ARMORY CASTLE BeyondTrust"
  ],
  "summary": "CVE-2026-102764 is an improper origin validation flaw in an internal messaging component of BeyondTrust Remote Support (CWE-290) that lets an unauthenticated remote attacker perform file operations on the appliance. Mandiant reports the suspected PRC-nexus actor ARMORY CASTLE (formerly UNC5221) exploited it as a zero-day from late August 2026, planting the SAWFLY web shell, escalating to root via a SUID shell copy, adding reboot-persistent sudoers changes, attempting to dump the appliance credential vault with bt-secrets, tunneling through a HAProxy route, and deleting logs. BeyondTrust patched SaaS by 2026-10-09 and disclosed on 2026-10-15. CISA added it to KEV on 2026-10-16.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "BeyondTrust is withholding technical details of the entry point and reports two affected customers as of 2026-10-16; Mandiant warns of broad exploitation after disclosure. Privileged Remote Access shares the code but BeyondTrust found no way to exploit it.",
  "firstObservedAt": "2026-08-29T00:00:00Z",
  "lastObservedAt": "2026-09-28T00:00:00Z",
  "publishedAt": "2026-10-16T17:53:24.110Z",
  "reviewedAt": "2026-10-16T17:53:18.426Z",
  "expiresAt": "2026-09-28T00:00:00Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "bt-advisory",
      "label": "BeyondTrust security advisory BT26-05",
      "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-05",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-15T00:00:00Z"
    },
    {
      "id": "bt-blog",
      "label": "BeyondTrust: ARMORY CASTLE and BT26-05",
      "url": "https://www.beyondtrust.com/blog/entry/bt26-05",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-16T16:00:00Z"
    },
    {
      "id": "mandiant",
      "label": "Mandiant / GTIG: ARMORY CASTLE Exploits BeyondTrust",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/",
      "sourceType": "research",
      "observedAt": "2026-10-15T00:00:00Z"
    },
    {
      "id": "kev",
      "label": "CISA Known Exploited Vulnerabilities catalog (2026.10.16)",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "sourceType": "government",
      "observedAt": "2026-10-16T17:15:48Z"
    },
    {
      "id": "nvd",
      "label": "NVD CVE-2026-102764",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102764",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-09-28T00:00:00Z"
    },
    {
      "id": "cveorg",
      "label": "CVE.org record CVE-2026-102764",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102764",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-10-15T20:30:32Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL blog: CVE-2026-102764 operator write-up",
      "url": "https://hol.org/blog/cve-2026-102764-beyondtrust-remote-support-file-upload-kev",
      "sourceType": "other_primary",
      "observedAt": "2026-09-28T00:00:00Z"
    }
  ],
  "artifacts": [],
  "indicators": [
    {
      "id": "sawfly-sha256",
      "indicatorType": "file_hash",
      "value": "dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb",
      "defanged": false,
      "confidence": "high"
    },
    {
      "id": "bareclaw-sha256",
      "indicatorType": "file_hash",
      "value": "1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462",
      "defanged": false,
      "confidence": "high"
    }
  ],
  "timeline": [
    {
      "id": "zero-day-exploitation",
      "occurredAt": "2026-08-29T00:00:00Z",
      "eventType": "first_observed",
      "summary": "Mandiant reports ARMORY CASTLE exploited the flaw as a zero-day in late August 2026.",
      "sourceIds": [
        "mandiant"
      ]
    },
    {
      "id": "saas-patched",
      "occurredAt": "2026-10-09T00:00:00Z",
      "eventType": "vendor_action",
      "summary": "BeyondTrust has applied the BT26-05 patch to all Remote Support SaaS tenants; self-hosted customers apply BT26-05-RS from /appliance.",
      "sourceIds": [
        "mandiant"
      ]
    },
    {
      "id": "public-disclosure",
      "occurredAt": "2026-10-15T20:30:32Z",
      "eventType": "disclosure",
      "summary": "Coordinated disclosure: CVE-2026-102764 published alongside advisory BT26-05 and Mandiant analysis.",
      "sourceIds": [
        "cveorg",
        "mandiant"
      ]
    },
    {
      "id": "cisa-kev-add",
      "occurredAt": "2026-10-16T17:15:48Z",
      "eventType": "other",
      "summary": "CISA adds CVE-2026-102764 to KEV (catalog 2026.10.16), federal due date 2026-10-19, forensic triage required.",
      "sourceIds": [
        "kev"
      ]
    }
  ],
  "coverage": [],
  "policies": [],
  "limitations": [
    "SaaS tenants patched by 2026-10-09; credential review still applies if exposed earlier",
    "Privileged Remote Access shares the code but BeyondTrust found no exploitation path; patch released as a precaution",
    "Flaw is on the appliance, not in Jump Clients or the representative console",
    "Patching does not evict an attacker who already established persistence"
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-102764-beyondtrust-remote-support-file-upload-kev/corrections"
}