Skip to content

BeyondTrust Remote Support exploit public: patch and hunt

BeyondTrust Remote Support CVE-2026-102764, a pre-authentication flaw that lets an attacker upload files to the appliance, was exploited as a zero-day from 29 August 2026 and has been in CISA's Known Exploited Vulnerabilities catalog since 16 October; by 2 November Rapid7 reported a public technical analysis and a Metasploit exploit module. Admins and MSPs running self-hosted Remote Support should confirm the BT26-05-RS patch is installed and check the appliance for compromise, because patching does not remove what an attacker already left behind.

Runbook card

What changes: a public exploit now exists for CVE-2026-102764 (CVSSv4 9.3), which BeyondTrust says was exploited before disclosure. Rapid7 expects unpatched appliances to be a target.
Who: self-hosted BeyondTrust Remote Support, "All versions <= 26.2.3" without the patch. Self-hosted Privileged Remote Access (PRA) should be patched too. SaaS customers were patched by BeyondTrust.
By when: now. CISA's federal due date was 19 October 2026 and has passed.
Do this: 1. Confirm BT26-05-RS is installed on every self-hosted appliance; versions older than 24.3.1 must upgrade first. 2. Hunt for the behaviours below, and get appliance logs into your SIEM. 3. If you find anything, preserve evidence, rebuild and rotate every credential the appliance stored or injected.
Check: the appliance's /appliance interface: installed version, BT26-05-RS patch status and whether automatic updates are on.
Source: BeyondTrust advisory BT26-05 (15 October 2026) and the CISA KEV catalog (version 2026.11.03).

What BeyondTrust says

Advisory BT26-05 (issued 15 October 2026) describes "Improper Origin Validation in an Internal Messaging Component" (CWE-290): internal Remote Support components "did not adequately validate the origin of the messages it received", which "could be used to perform file operations on the appliance". Severity "Critical", CVSSv4 9.3.

  • Affected: Remote Support "All versions <= 26.2.3".
  • Fixed: "BT26-05-RS patch for (v24.3.1 - v26.2.3)". "Customers on a Remote Support version older than 24.3.1 will need to upgrade to a newer version to apply this patch."
  • Self-hosted: apply the patch manually "if their instance is not subscribed to automatic updates in their /appliance interface".
  • SaaS: "As of Oct 9, 2026, a patch that remediates this vulnerability has been applied to all Remote Support SaaS customers." BeyondTrust's post says the patch shipped on 8 October and that SaaS instances of both Remote Support and PRA were patched automatically; for SaaS "no further action is required". Rapid7 still advises credential and configuration reviews for SaaS customers (see below).
  • Patch details: the advisory links BeyondTrust knowledge base article KB0024066.
  • PRA: BeyondTrust's blog says its testing "has not identified any way for an attacker to exploit this vulnerability in Privileged Remote Access", but PRA "shares the affected code", so it released a PRA patch and recommends self-hosted PRA customers "apply it immediately". Rapid7 suggests confirming the right PRA patch with BeyondTrust Support.

The Canadian Centre for Cyber Security alert AL26-025 (16 October 2026) adds that the flaw "requires no credentials or user action and can enable arbitrary file uploads, potentially resulting in full compromise of the appliance".

Exploitation, KEV and the public exploit

  • Zero-day use. BeyondTrust's incident post (last updated 16 October 2026) says that on 29 August 2026 the actor exploited the flaw "against a single BeyondTrust-hosted Remote Support instance and a single self-hosted Remote Support appliance". At that update it was "only aware of the two impacted customers". BeyondTrust assesses "with moderate to high confidence" that the activity belongs to the China-nexus actor that Google Threat Intelligence Group and Mandiant "track as UNC5221, which Mandiant now calls ARMORY CASTLE"; CrowdStrike tracks it as WARP PANDA. BeyondTrust also says it has "not seen evidence of adversary activity since August".
  • What the actor did (BeyondTrust's post): a web shell over the appliance's own web server, "full administrative control of the appliance within minutes", persistence "designed to survive a reboot", reading the appliance's stored secrets, then deleting logs and its own tooling. Rapid7, summarising Mandiant, adds root escalation and attempted credential-vault extraction. Mandiant's report "ARMORY CASTLE Exploits BeyondTrust" has the file hashes and YARA rules.
  • CISA KEV. Added 16 October 2026, due 19 October 2026, "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown" (KEV JSON, catalog version 2026.11.03, read 3 November 2026).
  • Public exploit. Rapid7's emergent threat post (updated 2 November 2026) says a technical analysis published on 30 October demonstrates "unauthenticated file upload leading to remote code execution as the site user", and "A Metasploit exploit module is also available". BeyondTrust's post warns that once a flaw like this is public, this actor "typically moves to broad exploitation of every instance still unpatched".

How to check

Read-only checks. Run them on every self-hosted appliance, including ones only partners or customers reach.

1. /appliance interface (each self-hosted Remote Support and PRA appliance):
   - installed version: 26.2.3 or earlier needs BT26-05-RS
   - is BT26-05-RS listed as installed?
   - is the appliance subscribed to automatic updates?
2. /login admin interface and your SIEM, from 29 August 2026 onwards:
   - administrative sessions from residential broadband or commercial VPN addresses
     that you cannot tie to a known admin or ticket
   - account, permission or session-policy changes you did not make,
     especially to Jump Items or Teams
   - gaps in syslog forwarding that start and end within one session

BeyondTrust's hunting list also includes "Unrecognized script files appearing in web directories, and web service accounts spawning shells". Rapid7 notes that customers "cannot audit the appliance host filesystem", so ask BeyondTrust Support to inspect the host for Mandiant's file indicators:

File Mandiant name SHA-256
mangoapi.php SAWFLY web shell dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb
ingredi_ws BARECLAW tunneler 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462

Other artifacts Rapid7 lists from Mandiant's report: /usr/bin/dbus-authd, /home/bomgar/sbin/post_boot.d/zz-root-persist, and an unauthorised /uidchanarge route in /ns/config/haproxy.conf. BeyondTrust says this actor rotates tooling "for every victim", and Rapid7 warns that "an absence of known indicators does not establish that an appliance is uncompromised". Hunt for the behaviours, not only the hashes. BeyondTrust customers can request its hunting package for this actor through the trust portal.

Reduce exposure

BeyondTrust's post: expose only the parts of the appliance your users and customers need, "restrict administrative interfaces to trusted networks", and allow outbound traffic from the appliance "only to the destinations they need". Forward appliance syslog and session events to your SIEM in near real time, because this actor deletes local logs.

How to verify the fix

The /appliance interface shows BT26-05-RS as installed on every self-hosted Remote Support appliance (and the PRA patch on PRA appliances), automatic updates are on where your change process allows it, and appliance syslog and session events arrive in your SIEM. Turning forwarding on now "cannot recover previously deleted evidence" (Rapid7), so keep whatever external logs you already have.

If you find something

Mandiant's advice, as summarised by Rapid7: preserve evidence before changes or reboots, isolate the appliance, and rebuild from a clean, fully patched image if compromise is confirmed or cannot be ruled out. BeyondTrust's post: "Image the appliance before you rebuild it", rotate "every credential the appliance stored or injected", watch those accounts for sign-ins outside a managed session, and review new MFA registrations on privileged accounts. Rapid7 says credential and configuration reviews "also apply to SaaS customers"; BeyondTrust says SaaS customers need no further action. Our note: one of the two victims was a BeyondTrust-hosted instance, so a SaaS review is cheap insurance. BeyondTrust asks customers with evidence of exploitation to open a Sev 1 support request citing "BT26-05".

Impact: a rebuild takes remote support offline for the appliance's users, and rotating brokered credentials touches every system the appliance reaches. Plan both with the teams or customers who depend on it. If the appliance holds Microsoft 365 or Entra admin credentials, rotate those first and review Entra sign-in and audit logs for those accounts.

Related: the CISA KEV round-up for late October covers other exploited edge devices, our ConnectWise cloud apps brief covers another remote-management supply-chain case, the PIM guide for Global Admins helps limit standing admin rights an appliance could expose, and dated actions are on Microsoft 365 security deadlines. More Threats & vulnerabilities news.

Sources

Last reviewed: 3 November 2026. Runbook Lab is not affiliated with BeyondTrust or Microsoft.