{"type":"bundle","id":"bundle--b5a090fa-abb4-5a9c-a607-2b7d7de854ec","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--6a25cee0-5eb6-5dab-b6f3-f0c585af0433","created":"2026-10-16T17:53:24.110Z","modified":"2026-10-16T17:53:24.110Z","name":"BeyondTrust Remote Support zero-day lets attackers plant a web shell without logging in, on CISA KEV (CVE-2026-102764)","description":"CVE-2026-102764 is an improper origin validation flaw in an internal messaging component of BeyondTrust Remote Support (CWE-290) that lets an unauthenticated remote attacker perform file operations on the appliance. Mandiant reports the suspected PRC-nexus actor ARMORY CASTLE (formerly UNC5221) exploited it as a zero-day from late August 2026, planting the SAWFLY web shell, escalating to root via a SUID shell copy, adding reboot-persistent sudoers changes, attempting to dump the appliance credential vault with bt-secrets, tunneling through a HAProxy route, and deleting logs. BeyondTrust patched SaaS by 2026-10-09 and disclosed on 2026-10-15. CISA added it to KEV on 2026-10-16.","aliases":["CVE-2026-102764","BT26-05","BeyondTrust Remote Support zero-day","Bomgar file upload","ARMORY CASTLE BeyondTrust"],"first_seen":"2026-08-29T00:00:00Z","last_seen":"2026-09-28T00:00:00Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"BeyondTrust security advisory BT26-05","url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05"},{"source_name":"BeyondTrust: ARMORY CASTLE and BT26-05","url":"https://www.beyondtrust.com/blog/entry/bt26-05"},{"source_name":"Mandiant / GTIG: ARMORY CASTLE Exploits BeyondTrust","url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/"},{"source_name":"CISA Known Exploited Vulnerabilities catalog (2026.10.16)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"source_name":"NVD CVE-2026-102764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102764"},{"source_name":"CVE.org record CVE-2026-102764","url":"https://www.cve.org/CVERecord?id=CVE-2026-102764"},{"source_name":"HOL blog: CVE-2026-102764 operator write-up","url":"https://hol.org/blog/cve-2026-102764-beyondtrust-remote-support-file-upload-kev"}]}]}