# BeyondTrust CVE-2026-102764: Patch, Then Hunt for SAWFLY

> A BeyondTrust Remote Support authentication bypass was exploited as a zero-day from late August 2026. SaaS instances are patched; self-hosted appliances need the BT26-05-RS patch, and patching does not remove an attacker who is already in. Here is what to patch, what to hunt for and what to rotate.

- URL: https://firewallsync.com/posts/beyondtrust-remote-support-cve-2026-102764-patch-and-hunt/
- Site: FirewallSync (https://firewallsync.com/)
- Topic: Security Operations
- Tags: vulnerability management, incident response, kev, remote access
- Published: 2026-10-22
- Author: Craig Leslie

## Key takeaways

- CVE-2026-102764 lets an unauthenticated remote attacker perform file operations on a BeyondTrust Remote Support appliance. It affects versions up to and including 26.2.3 and is rated CVSS 4.0 9.3 by BeyondTrust.
- It was exploited as a zero-day from August 29, 2026 against two customers, before BeyondTrust shipped a patch on October 8 and disclosed the flaw on October 15. CISA added it to KEV on October 16 with forensic triage required.
- SaaS customers need no patch action. Self-hosted appliances on 24.3.1 through 26.2.3 need the BT26-05-RS patch; older appliances must be upgraded first. BeyondTrust also patched Privileged Remote Access as a precaution.
- Google's threat intelligence group attributes the activity to ARMORY CASTLE, a suspected China-nexus espionage actor formerly tracked as UNC5221, which deployed a PHP web shell (SAWFLY), a tunneler (BARECLAW), a root backdoor and deleted local logs.
- Patching closes the hole but does not evict an intruder. If an appliance was internet-reachable on a vulnerable version, review it for compromise, and if compromise is found, rebuild it and rotate every credential it stored or brokered.



BeyondTrust Remote Support appliances running version 26.2.3 or earlier have an authentication bypass, CVE-2026-102764, that was exploited as a zero-day for about six weeks before it was disclosed. If you run a self-hosted appliance, apply the BT26-05-RS patch now. Then assume the appliance may have been compromised and check it, because the actor behind the attacks installed a web shell, a tunnel and a root backdoor that a patch does not remove.

**Scope.** On October 22, 2026 we read the CVE record, the KEV catalog (version 2026.10.21), BeyondTrust's blog post on BT26-05 (last updated October 16), Google Threat Intelligence Group's analysis, the Canadian Centre for Cyber Security's alert AL26-025 and Rapid7's analysis. BeyondTrust's advisory page for BT26-05 did not load for us, so patch and version details below come from the CVE record, the Cyber Centre and Google, and we say so where it matters. We did not test the vulnerability.

## The vulnerability

The CVE record, published by BeyondTrust on October 15, 2026, says internal components of Remote Support "did not adequately validate the origin of the messages it received", which "could allow an attacker to perform file operations on the appliance". It is classified as CWE-290, authentication bypass by spoofing, and affects Remote Support versions up to and including 26.2.3.

BeyondTrust scores it CVSS 4.0 9.3 (`AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H`): reachable over the network, no privileges, no user interaction. CISA's enrichment in the record rates it exploitation active, automatable yes, technical impact total. The Cyber Centre describes the impact as unauthorized file operations "including arbitrary file uploads, potentially leading to full appliance compromise".

That combination matters more than the score. Remote Support appliances sit at the edge, broker privileged sessions into internal systems and can store credentials. An unauthenticated file upload on such a device is a direct path to the systems it administers.

## Timeline

| Date (2026) | Event | Source |
|---|---|---|
| August 29 | The zero-day is used against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance | BeyondTrust; Google says "late August" |
| September 28 | BeyondTrust finds activity on the hosted instance and contains it, it says within 27 minutes of first detection | BeyondTrust |
| September 30 | Mandiant shares findings from the self-hosted customer's investigation | BeyondTrust |
| October 8 | Patch released to SaaS and self-hosted customers | BeyondTrust |
| October 9 | SaaS tenants patched | Google, Canadian Cyber Centre |
| October 15 | Coordinated disclosure: CVE, BeyondTrust blog, Google analysis | CVE record, BeyondTrust, Google |
| October 16 | CISA adds the CVE to KEV; due date October 19; forensic triage required | KEV catalog |

As of its last update on October 16, BeyondTrust said it knew of only those two affected customers and had seen no adversary activity since August. That is a statement about what BeyondTrust has observed, not a guarantee about every appliance.

## What to patch

| Deployment | Action | Source |
|---|---|---|
| Remote Support SaaS | No patch action; BeyondTrust says SaaS was patched automatically | BeyondTrust, Cyber Centre, Google |
| Self-hosted Remote Support 24.3.1 to 26.2.3 | Apply the BT26-05-RS patch (Google says from the `/appliance` interface) | Cyber Centre, Google |
| Self-hosted Remote Support older than 24.3.1 | Upgrade to a supported version, then apply the patch | Cyber Centre, Google |
| Self-hosted Privileged Remote Access | Apply BeyondTrust's precautionary PRA patch; BeyondTrust found no exploit path in PRA | BeyondTrust; Rapid7 says confirm the right patch with BeyondTrust Support |

The Cyber Centre also advises checking that automatic updates are enabled where appropriate. If you have more than one appliance, inventory them first; a forgotten secondary or lab instance is a common gap.

## What the attackers did

Google Threat Intelligence Group attributes the exploitation to ARMORY CASTLE, "a suspected PRC-nexus espionage threat actor (formerly tracked as UNC5221)". BeyondTrust attributes it, with moderate to high confidence, to the same group under its earlier name. Google's analysis describes:

- **SAWFLY**, an obfuscated PHP web shell named `mangoapi.php`, placed under the appliance's Laravel `public` directory, that returns HTTP 404 unless a specific POST parameter (`_c94mfe`) is present.
- **BARECLAW**, a tunneler at `/tmp/ingredi_ws` providing a SOCKS5 proxy over WebSocket, listening on local TCP port 19800 and exposed through an added HAProxy route, `/uidchanarge`, in `/ns/config/haproxy.conf`.
- A copy of `/bin/sh` at `/usr/bin/dbus-authd`, owned by root with the SUID bit set.
- Persistence through `/home/bomgar/sbin/post_boot.d/zz-root-persist`, which adds a passwordless sudo rule to `/ns/config/sudoers.template` and rebuilds `/etc/sudoers`.
- Deletion of logs on the appliance.

Google publishes these SHA-256 hashes:

| File | SHA-256 |
|---|---|
| `mangoapi.php` (SAWFLY) | `dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb` |
| `ingredi_ws` (BARECLAW) | `1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462` |

Rapid7 notes that customers cannot audit the appliance's host file system directly and should coordinate host-level inspection with BeyondTrust Support. BeyondTrust offers a threat-hunting package through its trust portal.

## How to hunt without relying on hashes

BeyondTrust warns that indicators from one victim "rarely reappear at the next" and that evidence stored only on the appliance may be missing or manipulated. Its blog and Google's analysis suggest hunting for behavior instead:

- Successful `/login` sessions from residential broadband or commercial VPN addresses, or outside business hours.
- `user_changed` events that raise Jump Item or team roles, and any unauthorized changes to accounts, permissions or session policies.
- Requests to unknown `.php` paths, and WebSocket upgrades from unexpected sources.
- Web service accounts spawning shells.
- Gaps in syslog forwarding, especially gaps that start and end within one session.

The last one depends on external logs. If the appliance does not already forward syslog and session events to a SIEM, BeyondTrust's advice is to start now; as Rapid7 points out, logging enabled today cannot recover evidence that was already deleted.

## If an appliance may be compromised

Google's recommended order, condensed:

1. **Preserve evidence first.** Snapshot virtual appliances with memory, and collect syslog, reverse-proxy or WAF and firewall logs before reboots or changes.
2. **Contain.** Block inbound traffic at the perimeter, restrict egress, end sessions, and disable, rather than delete, Jump Clients, Jumpoints and API accounts.
3. **Rebuild rather than clean.** Redeploy from a clean, patched image, and restore only configuration backups from before the exposure window.
4. **Rotate credentials after patching or rebuilding**, in dependency order: credentials in the vault and Password Safe, and any credential typed into a support session during the window. BeyondTrust adds: watch for unmanaged logins and review new MFA registrations on privileged accounts.
5. **Restrict the admin interfaces.** Limit `/login` and `/appliance` by IP and require single sign-on with phishing-resistant MFA.

If you find evidence of exploitation, BeyondTrust asks customers to open a severity 1 support case citing BT26-05.

For federal agencies, the KEV due date was October 19 and forensic triage is required; [our BOD 26-04 explainer](/posts/cisa-bod-26-04-explained-kev-deadlines-forensic-triage-and-what-private-teams-can-borrow/) covers what that triage involves and what private teams can borrow from it. For how a KEV listing should outrank a score when you prioritize, see [CVSS vs EPSS vs KEV](/posts/cvss-vs-epss-vs-kev-which-signal-should-decide-what-you-patch-first/).

## Limits of this article

BeyondTrust's BT26-05 advisory page did not load for us; we relied on its blog post, the CVE record, Google and the Canadian Cyber Centre for versions and patch names. Rapid7's article is a secondary source and is used only for statements it attributes to BeyondTrust or Mandiant and for its own clearly labelled advice. Attribution and indicators are Google's and BeyondTrust's; we have not verified them. Details may change as the vendors update their guidance.

## Sources and verification

Checked on October 22, 2026.

| Important claim | Source | Verification |
|---|---|---|
| Description, CWE-290, affected up to 26.2.3, CVSS 4.0 9.3 and vector, published October 15 | [CVE-2026-102764 record](https://www.cve.org/CVERecord?id=CVE-2026-102764) (read via the cvelistV5 repository) | Verified |
| CISA SSVC: exploitation active, automatable, total impact | CISA-ADP container in the CVE record | Verified |
| KEV: added October 16, due October 19, forensic triage Yes | [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), version 2026.10.21 | Verified |
| Timeline (August 29 to October 15), two affected customers, PRA precautionary patch, SaaS auto-patched, hunting behaviors, rotation advice, Sev 1 case | [BeyondTrust: ARMORY CASTLE and BT26-05](https://beyondtrust.com/blog/entry/bt26-05) | Verified against the vendor's blog |
| Attribution, malware names, file paths, HAProxy route, hashes, response steps | [Google Threat Intelligence: ARMORY CASTLE Exploits BeyondTrust](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust) | Qualified: Google's analysis, not independently verified |
| BT26-05-RS patch for 24.3.1 to 26.2.3; upgrade first if older; SaaS patched October 9 | [Canadian Centre for Cyber Security alert AL26-025](https://cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764) and Google | Verified across two sources |
| Host file system can't be audited directly; logs enabled now can't recover deleted evidence | [Rapid7 analysis](https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild) | Qualified: secondary source |

## Frequently asked questions

### Do BeyondTrust SaaS customers need to do anything?

Not to patch. BeyondTrust says SaaS instances of Remote Support and Privileged Remote Access were patched automatically; the Canadian Centre for Cyber Security and Google give October 9, 2026 as the date. Rapid7 and Google still recommend reviewing administrative changes and credentials, because one of the two known compromises was a BeyondTrust-hosted instance.

### Which self-hosted versions can take the BT26-05-RS patch?

Versions 24.3.1 through 26.2.3, according to the Canadian Centre for Cyber Security and Google. Appliances older than 24.3.1 must first be upgraded to a supported version and then patched. Google notes that upgrading does not remediate exposure that already happened.

### Is Privileged Remote Access (PRA) vulnerable?

BeyondTrust says PRA shares the affected code but its testing found no way to exploit the flaw in PRA. It released a PRA patch anyway as a precaution and recommends applying it to self-hosted PRA.

### If my appliance shows none of the published indicators, is it clean?

Not necessarily. BeyondTrust says indicators from one victim rarely reappear at the next and that evidence kept only on the appliance may not survive or may have been manipulated. Google reports the actor deleted on-appliance logs. Use the behavioral hunts and external logs, not just file hashes.


Image credit: Photo by [Taylor Vick](https://unsplash.com/photos/aWslrFhs1w4) on Unsplash