Summary

CVE-2026-102764 is a critical authentication bypass by spoofing vulnerability (CVSS 4.0: 9.3) in BeyondTrust Remote Support versions through 26.2.3. Improper origin validation in an internal messaging component lets a remote, unauthenticated attacker upload arbitrary files to the appliance. The suspected China-nexus group Armory Castle exploited it as a zero-day from 29 August 2026, deploying the SAWFLY web shell, escalating to root, harvesting stored credentials and tunnelling traffic through BARECLAW while wiping logs. Any exposed vulnerable appliance should therefore be treated as potentially compromised.

CVEs

Vulnerability Details

Affected products and CPE

Recommendations

1. 01
   Apply the BT26-05-RS Patch Immediately

   Self-hosted Remote Support appliances running versions 24.3.1 through 26.2.3 should apply the BT26-05-RS patch from the /appliance interface, or confirm it was applied automatically where the appliance is subscribed to automatic updates. Appliances older than 24.3.1 must first be upgraded to a supported release before the patch can be applied, and upgrading closes the flaw without remediating any prior exposure. Self-hosted Privileged Remote Access appliances should also receive the vendor's precautionary patch because they share the affected code. SaaS tenants were patched by the vendor and need no appliance-level action.
2. 02
   Preserve Evidence Before Making Changes

   Snapshot virtual appliances with memory and export the disk before any reboot or remediation, and request forensic preservation through BeyondTrust Support for hardware appliances and SaaS tenants. Collect syslog, reverse-proxy or WAF, and perimeter firewall logs for the full exposure window from systems outside the appliance, since the actor routinely deletes on-box logs and any evidence that remains locally cannot be implicitly trusted.
3. 03
   Isolate and Rebuild Suspected Appliances

   Block inbound traffic to a suspected appliance at the perimeter firewall rather than inside the appliance so its configuration remains intact for review, restrict egress to vendor update and licensing endpoints, end active sessions, and disable rather than delete Jump Clients, Jumpoints, and API accounts so the audit trail survives. Rebuild any appliance with confirmed or unknown compromise status from a clean, fully patched image, restore only a configuration backup dated before the exposure window, issue a new TLS certificate, and redeploy Jump Clients, Jumpoints, and the representative console from the rebuilt appliance, because host-level persistence survives reboots and configuration resets.
4. 04
   Hunt for Known Post-Exploitation Artifacts

   Look for a root-owned SUID binary at /usr/bin/dbus-authd, a zz-root-persist script under /home/bomgar/sbin/post_boot.d, NOPASSWD entries for the site service account in /ns/config/sudoers.template, unexpected PHP files in the web root, /tmp/ingredi_ws, and haproxy.conf entries routing the /uidchanarge path (ACL wswsws, backend webskd3) to a localhost listener on port 19800. Sweep with the published file hashes and YARA rules for SAWFLY and BARECLAW, and review appliance telemetry for user_changed events that raise Jump Item or team roles, administrative logins from residential broadband or commercial VPN address space, file-transfer events, and syslog forwarding gaps that open and close within a single session.
5. 05
   Rotate Brokered Credentials in Dependency Order

   Once the appliance has been patched or rebuilt, rotate /appliance administrative credentials, /login administrators and local users, API client secrets, security provider bind accounts and SAML signing keys, Remote Support Vault and integrated Password Safe or Privileged Remote Access credentials at the target systems, integration credentials such as SMTP, syslog, and ITSM connectors, and any credential typed into a support session during the exposure window. Rotating earlier hands fresh credentials to an attacker who may still control the appliance, and new multi-factor registrations on privileged accounts should be reviewed alongside rotation.
6. 06
   Reduce the Appliance's Exposure

   Restrict the /login and /appliance administrative interfaces to trusted IP ranges or network segments so that only representative console, customer portal, and Jump Client traffic remains reachable from the internet. Place a reverse proxy or WAF with full URI logging in front of the appliance to retain request paths the appliance itself cannot alter, and enforce default-deny outbound filtering that permits only vendor endpoints and the organization's own syslog and directory servers.

Indicators of Compromise (IoCs)

MITRE ATT&CK TTPs

References & Patch Links

Patch links

• https://www.beyondtrust.com/trust-center/security-advisories/bt26-05

References

• https://www.beyondtrust.com/blog/entry/bt26-05
• https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust