Vulnerabilities

BeyondTrust Remote Support, the helpdesk remote access platform formerly sold as Bomgar, has a critical flaw that was exploited for about seven weeks before it was disclosed. CVE-2026-102764 is an authentication bypass rated 9.3 under CVSS 4.0 that lets an attacker with no account perform file operations on the appliance. Every self-hosted Remote Support version up to and including 26.2.3 is affected. BeyondTrust published advisory BT26-05 on October 15, alongside an investigation by Google Threat Intelligence Group (GTIG) and Mandiant.

The attacker is a suspected China-nexus espionage group that Mandiant now calls ARMORY CASTLE, previously tracked as UNC5221 (CrowdStrike's name for it is Warp Panda). Exploitation goes back to at least August 29. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 16 and gave US federal agencies until October 19 to act. If you run a self-hosted Remote Support appliance that was reachable from the internet in that window, patching is the first step, not the last: Mandiant says such an appliance should be treated as potentially compromised until it has been reviewed.

How it works

A Remote Support appliance brokers sessions between support staff and the machines they fix. Technicians work through /login, connect to Jump Clients on endpoints and pull passwords from the built-in Vault; /appliance manages the box itself. So the appliance holds, or can inject, credentials for much of the estate it supports.

The bug sits in how the product decides whether a request is trusted. BeyondTrust's own wording, quoted by The Hacker News, is that "the components did not adequately validate the origin of the messages it received". CISA's KEV entry classes it as authentication bypass by spoofing (CWE-290): a request that looks like it comes from a trusted component is accepted without a login, and it can read or write files on the appliance.

Writing files to a web server is enough for code execution. In the intrusion Mandiant investigated, the attacker sent POST requests to a staging file named app_84304470%2Ephp, then placed a PHP web shell, mangoapi.php, which Mandiant calls Sawfly. A web shell is a script that runs commands the attacker sends through ordinary web requests. Sawfly encrypts its traffic with RC4 and answers HTTP 404 to any request missing its secret parameter, so a casual probe sees nothing.

Privileged Remote Access (PRA), BeyondTrust's sister product, shares the affected code. BeyondTrust told BleepingComputer its internal testing found no way to exploit the flaw in PRA, but it released a PRA patch anyway and recommends self-hosted PRA customers apply it.

What attackers are doing

The web shell ran as the appliance's web service account. Mandiant describes the actor elevating from there to root: it copied /bin/sh to /usr/bin/dbus-authd, made root the owner and set the SUID bit, which makes a program run with its owner's privileges whoever starts it. For persistence it added a boot script, /home/bomgar/sbin/post_boot.d/zz-root-persist, which writes a passwordless sudo rule for the service account into the sudoers template every time the appliance starts.

With root, the actor read credentials from the appliance's secrets store and deleted system, web server and application logs. It installed Bareclaw (binary name ingredi_ws), a tunneler written in C that offers a SOCKS5 proxy over WebSocket, and edited the appliance's HAProxy configuration so requests to the path /uidchanarge were routed to it. That turned the appliance into a relay into the internal network, reachable through its own web front end.

Then the actor used the product as designed. It signed in to the web portal with a compromised Administrator account, raised that account's Jump Item and team roles from No Access to Administrator, started remote support sessions on user desktops, and used the file transfer feature to take software inventories off them.

Victim numbers have not been published. ARMORY CASTLE has a long record of zero-days in edge devices, and GTIG assesses with high confidence that it will keep using them.

What to do

1. Patch

SaaS tenants were patched by BeyondTrust before disclosure. GTIG, The Hacker News and Cybersecurity Dive give October 9; BleepingComputer gives October 8.

Self-hosted appliances on 24.3.1 through 26.2.3 need patch BT26-05-RS. Sign in to /appliance and check whether automatic updates already installed it; if not, apply it from that interface. If the patch does not show up, Mandiant suggests opening a BeyondTrust Support case that references BT26-05. Appliances older than 24.3.1 have no patch: upgrade to a supported version first, then apply BT26-05-RS. Patch self-hosted PRA as well.

2. If you cannot patch today

Expose only the services your users and customers need, as CISA advises, and limit /login and /appliance to trusted source IPs. Mandiant also suggests putting a web application firewall or reverse proxy with full URI logging in front, and enforcing SAML single sign-on with phishing-resistant multi-factor authentication (MFA).

3. Check whether you were hit

Snapshot a virtual appliance, including memory, or image a physical one before you reboot or change anything. If you suspect compromise, block inbound traffic at the firewall rather than in /appliance, and allow outbound traffic only to BeyondTrust's update and licensing endpoints. You cannot browse the appliance's host file system yourself, and the attacker deleted local logs, so the useful evidence lives elsewhere: in the copy of the appliance syslog held by your security information and event management (SIEM) system, in reverse proxy and firewall logs, and in BeyondTrust's session reports. Look for:

• requests to .php paths that are not part of the product, and WebSocket upgrades from addresses outside your support staff and endpoint ranges;
• user_changed events that raise a Jump Item or team role, plus user_added, api_account and security_provider events with no change ticket behind them;
• file transfer events, and sessions started by any account whose role changed;
• gaps in syslog forwarding. Mandiant notes that an interruption lasting exactly one session is a strong sign of log tampering.

Mandiant has published YARA rules and SHA-256 hashes for Sawfly and Bareclaw to run against the disk image.

4. Rebuild and rotate

On an appliance that was already entered, patching closes the hole but leaves the root backdoor in place, and Mandiant notes that host-level persistence survives a reboot and a configuration reset. Redeploy any appliance whose status is confirmed compromised or unknown from a clean, fully patched image. Restore a configuration backup from before the exposure window, or restore the newest one while isolated and check users, roles, API accounts and security providers against a known baseline first. Issue a new TLS certificate and redeploy Jump Clients, Jumpoints and the representative console.

Rotate credentials only after the appliance is patched or rebuilt, or the attacker reads the new ones too. Mandiant's order is: /appliance admins, /login administrators and local users, API client secrets, security provider bind accounts and SAML signing keys, Vault and integrated Password Safe credentials (changed on the target systems), then SMTP, syslog, ticketing and other integration secrets. CISA adds revoking all active support sessions and reviewing new MFA registrations on privileged accounts. Use the session reports to list every endpoint the attacker touched.

Remote access tools are tier-zero systems

A remote support appliance can reach and log in to most of an organisation's endpoints, so it belongs in the same protection tier as a domain controller. Here the attacker deleted local logs and changed admin roles through the normal portal. Teams that forward appliance syslog to a SIEM from day one, alert on user_changed role increases, and keep /appliance reachable only from an admin network would still have a record of both after the attacker cleaned up.

Our security operations team can take in BeyondTrust syslog and hunt the events above, and our attack surface management work finds remote access portals you did not know were exposed. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: Google Threat Intelligence Group and Mandiant, CISA alert, CISA KEV catalog, BeyondTrust advisory BT26-05, BleepingComputer, The Hacker News, Cybersecurity Dive, SOC Prime, eSecurity Planet.