BeyondTrust Remote Support zero-day, and the message with no return address
An IT helpdesk at a federal civilian agency reaches employee laptops through a BeyondTrust Remote Support appliance sitting at the perimeter. The appliance listens on public HTTPS for remote representatives and on an internal bus for its own services. On August 29, 2026, somebody dropped a message onto that bus from outside the appliance and the service listening at the other end accepted it as if it had come from inside. Six weeks later BeyondTrust shipped a patch. On October 16 CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of October 19.
Google's Threat Intelligence Group attributes the operation to ARMORY CASTLE, a suspected PRC-nexus espionage actor that Mandiant previously tracked as UNC5221. Two BeyondTrust-hosted Remote Support tenants were compromised in that first attack wave. The world found out on October 15, when BeyondTrust disclosed BT26-05.
An unaddressed message walks into an appliance
BeyondTrust describes the flaw plainly in advisory BT26-05: CWE-290, improper origin validation, in an internal messaging component of Remote Support. The component did not adequately check where received messages came from. The practical effect, confirmed in the ARMORY CASTLE writeup, is that an unauthenticated attacker on the network can perform file operations against the appliance filesystem, up to and including arbitrary file writes.
What makes this different from the usual preauth upload bug is where the file lands. The service account on these boxes keeps a Laravel-backed web stack at /%SITE_SERVICE_ACCOUNT%/ingredi/app/laravel/public/, a directory the appliance serves back out over HTTPS. Mandiant observed the actor write a staging shell at /app_84304470%2Ephp first (that file was never recovered in the investigation), then a persistent PHP webshell called mangoapi.php under laravel/public. The shell belongs to a family GTIG names SAWFLY: it returns 404 unless a parameter named _c94mfe carries a Base32-encoded, RC4-encrypted command, and then it decrypts and runs the payload through @eval(). The appliance serves both files, because they are now in its own public web root.
Scoring: NVD rates the flaw CVSS 9.8 under v3.1, and BeyondTrust rates it 9.3 under CVSS v4.0 in its own advisory. CVSS v4.0 captures the user interaction and attack complexity better; v3.1 clusters more of these finds at the top of the scale.
From file upload to root in two moves
The webshell runs as the unprivileged site service account. On a general-purpose Linux host that is where the story stays. Remote Support is a shipped virtual appliance, though, with a small set of binaries that the service account can touch, and ARMORY CASTLE used two of them.
First move: the actor copied /bin/sh to /usr/bin/dbus-authd, a path that looks like a system daemon (which is the point), changed the owner to root, and set the SUID bit. Running /usr/bin/dbus-authd from the webshell now spawned a root shell on demand. Second move: for durability, they dropped /home/bomgar/sbin/post_boot.d/zz-root-persist, a script that runs each boot and appends a passwordless sudo entry for the site service account into /ns/config/sudoers.template, then runs /ns/sbin/bt-sysconfig --no-restart misc to regenerate /etc/sudoers from the template. If an administrator notices the SUID binary and removes it, the next reboot rebuilds the sudo backdoor.
/bin/sh, and a boot hook under post_boot.d. The chain from unauth file write to root takes two commands because the box was built to make them easy.
What a root appliance means in this product
Once root, the two actions that mattered to ARMORY CASTLE were credential theft and lateral access. The actor ran /ns/sbin/bt-secrets against the appliance's site-specific vault, then against the global vault, which gave up stored secrets for every integration and representative the appliance had ever authenticated. They deleted /home/bomgar/log/bt-secrets.log* afterward to clear the audit trail.
They logged into the web admin portal with the harvested credentials, raised their own account's Jump Item and Team roles from No Access to Administrator (which left a user_changed event in the audit log), and started remote support sessions into the downstream machines the appliance was already trusted to reach. On at least one engagement they requested full file system access and used the Remote Support file transfer service to pull software inventories off customer endpoints, a quiet way to pick the next target without touching endpoint tools.
For a tunnel they built BARECLAW, a C binary at ingredi_ws that embeds CivetWeb and OpenSSL and speaks SOCKS5 over a WebSocket. They did not open a new port. They modified /ns/config/haproxy.conf to route the path /uidchanarge on the appliance's public HTTPS listener to a loopback backend on 127.0.0.1:19800, where BARECLAW listens. From the outside it looked like a normal customer URL. The appliance kept answering real support requests on every other path at the same time.
Everything above was followed by log deletion in bulk. The scrub covered /ns/log/auth.log, ssl.log, proto-handler.log, bt-docker.log, http-access.log, http-errors.log, php-fpm.log, php-fpm-access.log, php_debug.log, php_web_errors.log, /var/log/messages, the two Laravel httpd logs under the service account home, and /tmp/sshauth.*. If syslog is not already forwarded off the box over TLS, the intrusion will not be fully reconstructable from what remains on disk.
The number says 9.8, the posture question does not
A severity-sorted queue puts CVE-2026-102764 at the top this week and so does a KEV-aware queue. Neither of those answers the question the operations team actually has to resolve, which is whether a given Remote Support instance was reachable from the public internet in the exploitation window, whether it is still reachable, and whether the Jump Items it holds touch systems that would hurt. A CVSS score alone cannot distinguish between an appliance exposed on 443 to the world and the same software behind an identity-aware proxy on a private VLAN. Both score 9.8. Only one of them is a drop-everything-today finding.
Reading this through TRIS, four layers deep
TRIS, the Threat and Risk Intelligence Scoring engine inside CVEasy AI, grades the finding across the signals that decide how it should land on a queue.
Base severity. CVSS 9.8 under NVD v3.1 and 9.3 under BeyondTrust's CVSS v4.0 both place the flaw at the top of the technical scale. TRIS carries the number through but does not stop there.
Exploitation status. This is the KEV finding of the week. Mandiant tied the activity to ARMORY CASTLE starting August 29, BeyondTrust patched the SaaS fleet on October 9, disclosed on October 15, and CISA listed it on October 16. Confirmed in-the-wild abuse, named actor, patched vendor, open hunting detail from GTIG. No residual uncertainty on whether an exploit exists.
Exposure. An internet-facing Remote Support appliance, customer-reachable HTTPS on the Bomgar listener, earns the top ACT band because an unauthenticated attacker on the public network can reach the vulnerable message handler directly. The same appliance behind an identity-aware proxy, or on a private segment with the listener firewalled, drops two bands because the attack path does not land. A patched 26.2.3 install with no evidence of pre-patch compromise drops lower again. One CVE, three or four distinct scores depending on where it actually lives.
Blast radius. A Remote Support appliance that holds Jump Items into production, admin credentials in the vault, and representative tokens is weighted against those downstream assets. The finding on an appliance that reaches your crown jewels scores above the same finding on a test instance connected to a lab subnet, because the Jump Item inventory is itself a crown jewel.
Same CVE, four distinct scores, because that is the question the operations team is actually trying to answer: not how bad is this bug in the abstract, but how bad is it on my appliance today.
Patch, hunt, and when to rebuild
Patch target: BT26-05-RS, which covers Remote Support 24.3.1 through 26.2.3. If you are on an older release, upgrade to 24.3.1 first, then apply the patch. BeyondTrust applied the fix to all SaaS tenants on October 9. Self-hosted customers should verify the patch landed through the /appliance interface or the automatic update stream. Note that BeyondTrust also shipped a companion patch for Privileged Remote Access because the two products share a code base, even though exploitation against PRA has not been confirmed.
Hunt before you accept green. Pull appliance logs from August 29 forward and look for POST requests to /app_84304470%2Ephp or similarly numeric PHP paths under the public web root, and for the appearance of mangoapi.php anywhere under laravel/public. Verify that /usr/bin/dbus-authd either does not exist on the box, or is the expected daemon rather than /bin/sh owned by root with the SUID bit set. Check /ns/config/sudoers.template for a passwordless entry for the site service account. Pull /ns/config/haproxy.conf and look for a loopback backend on 127.0.0.1:19800 or any unexplained route to 127.0.0.1. Diff the audit log for user_changed events that raised an account to Administrator on Jump Items or Teams.
How CVEasy AI surfaces this
CVEasy AI, the number one local-first CTEM platform, ingests the KEV catalog, BeyondTrust's advisory feed, and the GTIG and vendor-independent writeups directly, then runs them through TRIS against the inventory on your own hardware. For a Remote Support appliance that your BASzy AI scan has already fingerprinted at the perimeter, TRIS lands the finding at the top of the ACT band this morning, pulls the hunting checklist above into a runbook, and tells you whether that appliance was reachable in the exploitation window, without round-tripping the inventory to anyone else's cloud. Your appliance list, your Jump Item map, and your vault audit stay on your hardware.
Sources: CISA KEV, BeyondTrust BT26-05, Google Threat Intelligence Group on ARMORY CASTLE, watchTowr FAQ, Belgium CCB advisory.