CVE-2026-102764: Unauthenticated file upload in BeyondTrust Remote Support

What it is

Remote Support’s internal messaging components don’t properly check where a message comes from (CWE-290, origin validation). An unauthenticated attacker on the network can abuse that to perform file operations on the appliance. Google’s analysis describes it as an arbitrary file upload, and the actor used it to drop a PHP webshell. BeyondTrust has not published more technical detail, saying it would put self-hosted customers at risk.

This was a zero-day. BeyondTrust says a suspected China-nexus espionage actor used it from August 29, 2026, weeks before the patch. Google tracks the actor as ARMORY CASTLE (formerly UNC5221); BeyondTrust also cites CrowdStrike’s name, WARP PANDA. BeyondTrust knows of two victims, one hosted by BeyondTrust and one self-hosted, and has seen no activity since August. Google warns the actor may now exploit it broadly, as it did with Ivanti bugs in 2024.

CISA added it to KEV on October 16 and requires action by October 19. CISA also asks for forensic triage, not just patching. Ransomware use is not reported.

This is a different bug from the earlier CVE-2026-1731.

Am I affected?

• Self-hosted Remote Support up to 26.2.3: yes, until you apply BT26-05-RS. The vendor record lists versions 0 through 26.2.3.
• Remote Support SaaS: BeyondTrust patched it automatically. The appliance needs no action, but if you suspect exposure, still rotate credentials (see below).
• Privileged Remote Access (PRA): BeyondTrust found no way to exploit it, but PRA shares the code and received the patch as a precaution.

Exposure is highest if the appliance was reachable from the internet. BeyondTrust’s page gives no menu path or command for checking the version, so use the appliance’s own admin interface or your records.

What to do

1. Preserve evidence first. Google advises snapshotting the VM with memory and collecting reverse proxy, WAF and firewall logs before any change or reboot. The actor deletes on-appliance logs. BeyondTrust likewise says to image the appliance before rebuilding.
2. Patch. On self-hosted 24.3.1 or later, apply BT26-05-RS from /appliance. On anything older than 24.3.1, upgrade to a supported version and then apply the patch. Upgrading does not remove an existing compromise.
3. Harden exposure. BeyondTrust offers no workaround for this CVE. It recommends exposing only what users need, restricting admin interfaces to trusted networks, and limiting outbound traffic from the appliance. Its guides: Remote Support and PRA. Google also advises blocking TCP 19800 and the /uidchanarge path.
4. If the appliance was internet-reachable on a vulnerable version, treat it as compromised. Google prefers a rebuild from a clean image, because host persistence survives reboots and config resets.
5. Rotate credentials after patching or rebuilding. Google lists the Vault, Password Safe, PRA, API secrets, SAML keys, and any credentials typed into support sessions. BeyondTrust says to rotate everything the appliance stored or injected.
6. If you find evidence of exploitation, open a Sev 1 support request citing “BT26-05”. BeyondTrust customers can also request a threat hunting package through its trust portal.

Detection

Hunt back to at least August 29, 2026. Local logs may be gone, so rely on external logs and your SIEM.

Network and proxy logs (Google):

• POSTs to /app_84304470%2Ephp, and .php paths outside the known Remote Support paths.
• WebSocket upgrades to /uidchanarge, or any traffic to TCP 19800.

Appliance files (Google). Check for:

• mangoapi.php in the web root. SAWFLY returns a 404 unless the request has the _c94mfe POST parameter.
• /usr/bin/dbus-authd, a SUID-root shell copy.
• /tmp/ingredi_ws, the BARECLAW SOCKS5 tunneler.
• /home/bomgar/sbin/post_boot.d/zz-root-persist.
• A NOPASSWD: ALL line for the site service account in /ns/config/sudoers.template.
• A /uidchanarge route in /ns/config/haproxy.conf.
• Missing logs, including /home/bomgar/log/bt-secrets.log*.

Google published YARA rules (G_Hunting_Webshell_SAWFLY_1, G_Hunting_Backdoor_BARECLAW_1) in its article.

Application events and sessions (Google, BeyondTrust):

• user_changed events raising Jump Item or Team roles from No Access to Administrator. Also user_added, api_account and security_provider events with no change ticket.
• /login successes from residential broadband or commercial VPN addresses, and admin logins outside business hours.
• File-transfer events and sessions started by accounts whose roles changed.
• New MFA registrations on privileged accounts, and brokered credentials used outside a managed session.
• Gaps in syslog forwarding, especially a gap that starts and ends within one session.