# BeyondTrust Remote Support zero-day, from file upload to the whole credential vault

Source: https://startwithidentity.com/cves/cve-2026-102764/
Last updated: 2026-10-16
License: content by Start with Identity. Cite the source URL.

---

## What broke

CVE-2026-102764 (CVSS 4.0 score 9.3) is an improper origin validation flaw in an internal messaging component of [BeyondTrust](https://startwithidentity.com/vendors/pam/beyondtrust/) Remote Support, formerly Bomgar. Under the right conditions it lets an unauthenticated remote attacker perform file operations on the appliance, which in practice meant uploading a PHP file to the web root. CISA describes it as a critical authentication bypass. All self-hosted versions through 26.2.3 are affected. The fix is patch BT26-05-RS from advisory BT26-05; versions older than 24.3.1 must upgrade before they can take it. SaaS tenants were patched on October 9, 2026.

BeyondTrust says the flaw was first exploited on August 29, 2026, against a single self-hosted appliance. Google Threat Intelligence and Mandiant attribute the activity to ARMORY CASTLE (formerly UNC5221), a suspected China-nexus espionage group. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 16, 2026.

## Why it matters

Remote Support is a [PAM](https://startwithidentity.com/glossary/pam/) control plane, not a help-desk widget. Mandiant's write-up shows what that means once the box is owned: a root SUID backdoor, then the `bt-secrets` CLI used to export the vault, first for the site service account and then for every administrative credential. The attacker logged into `/login` as a real administrator, raised its own Jump Item and Team roles from "No Access" to "Administrator", and opened sessions with full file-system access on user desktops. Every downstream action ran under brokered, legitimate-looking admin identity. It also deleted local logs, so the appliance cannot be trusted to tell you what happened.

## What to do

- Apply BT26-05-RS, or upgrade then patch if you are below 24.3.1. Confirm the build on the appliance itself.
- Restrict `/login` and `/appliance` to admin networks by IP, put administrators behind SAML SSO with [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/), and set the default Jump Item role to No Access.
- Forward syslog off the box and alert on `user_changed` events that raise roles, new `api_account` or `security_provider` events, unknown `.php` paths, and gaps in log forwarding.

## After you patch

- If the appliance ran a vulnerable build, snapshot it with memory for forensics, then rebuild from a clean, patched image rather than cleaning in place.
- Rotate in dependency order: appliance admin, `/login` administrators, API secrets, SAML and directory bind accounts, vault and PRA credentials, then integration secrets.
- Revoke active support sessions and review new MFA registrations on privileged accounts.
- Diff Jump Item and Team role assignments against a pre-August 2026 baseline.

## Sources

- [NVD: CVE-2026-102764](https://nvd.nist.gov/vuln/detail/cve-2026-102764)
- [Google Threat Intelligence: ARMORY CASTLE exploits BeyondTrust](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust)
- [CISA alert, October 16, 2026](https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support)
- [The Hacker News, October 16, 2026](https://thehackernews.com/2026/10/china-linked-hackers-exploited.html)
- BeyondTrust security advisory BT26-05