Attackers exploited a BeyondTrust Remote Support zero-day: apply BT26-05

• Affected: self-hosted BeyondTrust Remote Support, all versions up to 26.2.3 without the BT26-05-RS patch.
• Fixed in: the BT26-05-RS patch for 24.3.1 to 26.2.3. Older versions must upgrade first. SaaS was patched by BeyondTrust.
• Exploited? Yes. In CISA KEV since 16 October 2026 (checked 27 October 2026). BeyondTrust traces the first attack to 29 August 2026.
• Do this now: confirm the patch in /appliance, then review logs kept off the appliance for signs of compromise.

What happened

An attacker who can reach a self-hosted BeyondTrust Remote Support appliance can write files on it without logging in. In the intrusion Mandiant investigated, that became a web shell, root access and a raid on stored credentials.

BeyondTrust disclosed CVE-2026-102764 in advisory BT26-05 on 15 October 2026. CISA added it to its Known Exploited Vulnerabilities catalog on 16 October. We are covering it 11 days after that listing, and the federal deadline has passed.

The flaw sits in internal messaging components of Remote Support. They did not check where incoming messages came from. BeyondTrust files it as CWE-290, authentication bypass by spoofing.

BeyondTrust scores it CVSS 4.0 9.3 (Critical). NVD adds a CVSS 3.1 score of 9.8. BeyondTrust is withholding technical details while self-hosted customers patch.

This was a zero-day. BeyondTrust says an attacker used it on 29 August 2026 against one BeyondTrust-hosted instance and one self-hosted appliance. The company found the hosted intrusion on 28 September and released the patch on 8 October.

Who is affected

The risk sits with self-hosted Remote Support appliances that are reachable from the internet. BeyondTrust lists every version up to 26.2.3 as affected. The fix is a patch, BT26-05-RS, so the version number alone does not tell you whether you are safe.

Am I affected? Check three things. Is your Remote Support appliance self-hosted? Is it on 26.2.3 or earlier? Does /appliance show BT26-05-RS as installed? If the answers are yes, yes and no, you are exposed.

Automatic updates may already have applied the patch. BeyondTrust tells customers who are not subscribed to install it by hand.

What is confirmed

BeyondTrust, NVD, CVE.org and CISA agree on the product, the affected range and the CWE. CISA lists the flaw as exploited, with a due date of 19 October 2026 for federal agencies. It marks ransomware use as unknown and flags the entry for forensic triage.

BeyondTrust confirms two victims of the zero-day phase. As of its last update on 16 October, it knew of no other affected customers. It had seen no attacker activity since August.

Mandiant documented the self-hosted intrusion. The attacker planted a PHP web shell it calls SAWFLY in the appliance web root. It then created a root-owned copy of the system shell with the SUID bit set.

The attacker also tried to dump the appliance's credential vault with a built-in BeyondTrust utility. It added a startup script that grants the site service account passwordless root through the sudoers template. Then it deleted logs.

Inside the Remote Support application, the attacker logged in with a stolen administrator account. It raised that account's Jump Item and Team permissions from No Access to Administrator. It then opened support sessions to internal machines and downloaded documents.

Mandiant also found a SOCKS5 tunneler, BARECLAW. The attacker exposed it to the internet by editing the appliance's HAProxy configuration.

Google's threat intelligence group attributes the activity to ARMORY CASTLE, a suspected China-nexus espionage group formerly tracked as UNC5221. BeyondTrust shares that assessment with moderate to high confidence. BeyondTrust notes the group's earlier zero-day use against Citrix NetScaler and Ivanti Connect Secure.

The Canadian Centre for Cyber Security issued alert AL26-025 on 16 October with the same fix guidance.

What is not confirmed

Nobody has published a count of exploited appliances after disclosure. Mandiant warns that this group has moved to broad exploitation after past disclosures. That is a warning, not an observation for this CVE.

We found no working public exploit code. Two GitHub repositories claim a proof of concept. We read both without running anything. Each holds only a README, and one asks readers to make contact for private access.

The second README describes an internal protocol and exploit modules that no vendor source supports. Treat both as unverified at best, and as possible lures. Do not run code from them.

Privileged Remote Access is not confirmed as vulnerable. BeyondTrust's advisory lists only Remote Support. Its blog says PRA shares the affected code, so it shipped a patch anyway.

There is a one-day gap on the SaaS fix. BeyondTrust's blog says SaaS was patched on 8 October. The advisory and Mandiant say 9 October.

The attribution is the assessment of Google and BeyondTrust. We did not verify it. BeyondTrust's view that the actor used AI tooling has no forensic proof, by its own account.

What to do

1. Confirm BT26-05-RS is installed on every self-hosted Remote Support appliance. Upgrade anything older than 24.3.1 first.
2. Patch self-hosted Privileged Remote Access too, as BeyondTrust recommends.
3. Treat any appliance exposed while unpatched as possibly compromised. That window runs from 29 August to your patch date.
4. Review syslog copies held off the appliance. The attacker deleted local logs, so on-box logs cannot be trusted.
5. Look for Jump Item or Team roles raised to Administrator without a change ticket, and admin logins from VPN or home broadband addresses.
6. Check for unknown PHP files in web directories, unexpected SUID binaries, new startup scripts, and edits to the sudoers template or HAProxy configuration.
7. If you find anything, image the appliance and rebuild it from a clean, patched image. Then rotate every credential it stored or brokered.
8. Restrict the /login and /appliance admin interfaces to trusted networks. Forward appliance logs to your SIEM in near real time.

BeyondTrust asks customers who find evidence of exploitation to open a Sev 1 support case citing BT26-05.

Our take

A remote support appliance is a master key. It holds privileged credentials and a ready-made route to every machine it manages. That is why the attacker went straight for the vault and Jump Item rights.

This is the fourth BeyondTrust Remote Support flaw in CISA KEV since December 2024, after CVE-2024-12356, CVE-2024-12686 and CVE-2026-1731. The sources do not link those cases to this campaign.

The pattern matches other remote access and edge flaws we covered, such as the exploited VeloCloud Orchestrator injection and the AnyDesk for Linux pre-auth exploit. Patching closes the hole. It does not remove an attacker who got in first.