{"slug":"beyondtrust-remote-support-cve-2026-102764","title":"BeyondTrust Remote Support origin-validation bypass (CVE-2026-102764)","shortName":"BeyondTrust RS","seoTitle":"BeyondTrust RS (CVE-2026-102764): KEV, versions & detection","summary":"Improper origin validation in BeyondTrust Remote Support internal messaging (CVE-2026-102764, CWE-290) that the vendor says can let an attacker perform file operations on the appliance. NVD CVSS 3.1 9.8. BeyondTrust dates first use to 29 Aug 2026 (ARMORY CASTLE / UNC5221). Mandiant dates the same activity to late August 2026. CISA KEV added 16 Oct 2026 (due 19 Oct, ransomware use Unknown). Rapid7 (30 Oct 2026) reports unauthenticated file upload to RCE as the site user on 24.1.2. Public unmerged Metasploit PR. Patched: BT26-05-RS for 24.3.1 through 26.2.3; SaaS patched 9 Oct 2026.","isExample":false,"draft":false,"family":"beyondtrust-remote-support-cve-2026-102764","kind":"single-product","aliases":["CVE-2026-102764","BT26-05","BeyondTrust Remote Support","ARMORY CASTLE"],"publishedAt":"2026-10-31","updatedAt":"2026-10-31","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2026-102764","cvss":{"cve":"CVE-2026-102764","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102764","sourceDate":"2026-10-17","checkedDate":"2026-10-31","dateLabel":"NVD Analyzed","sourceLabel":"NVD record (Primary CVSS 3.1; CNA also published CVSS 4.0 9.3)","nvdPublishedDate":"2026-10-15"},"epss":{"cve":"CVE-2026-102764","score":0.1895,"percentile":0.97301,"date":"2026-10-31","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102764","checkedDate":"2026-10-31"},"kev":{"cve":"CVE-2026-102764","listed":true,"dateAdded":"2026-10-16","dueDate":"2026-10-19","catalogVersion":"2026.10.30","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-31"},"addedDate":"2026-10-31"},"priority":{"label":"act-now"},"managementSummary":{"what":"Origin-validation bypass in BeyondTrust Remote Support (CVE-2026-102764). NVD CVSS 3.1 9.8. BeyondTrust dates first use to 29 Aug 2026. Mandiant dates the same activity to late August 2026. CISA KEV 16 Oct 2026 (due 19 Oct; ransomware use Unknown). Rapid7 reports unauthenticated file upload to RCE as the site user on 24.1.2.","action":"Apply BT26-05-RS on self-hosted Remote Support 24.3.1 through 26.2.3. Upgrade older builds first. SaaS was patched 9 Oct 2026. If the appliance was reachable while vulnerable, treat it as potentially compromised, hunt Mandiant artefacts, then rotate stored credentials."},"seenInTheWild":[{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2026-10-16","method":"CISA KEV catalog 2026.10.30, dateAdded 2026-10-16, due 2026-10-19, knownRansomwareCampaignUse Unknown, forensicTriage Yes","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"metric":"vendor-stated","value":"Two customers (one BeyondTrust-hosted, one self-hosted)","observer":"BeyondTrust","date":"2026-08-29","method":"BT26-05 blog (published 15 Oct 2026, last updated 16 Oct 2026 12:00 p.m. EDT). Timeline dates both known victims to 29 Aug 2026. As of the 16 Oct update, BeyondTrust said it was only aware of those two customers and had not seen evidence of adversary activity since August.","sourceUrl":"https://www.beyondtrust.com/blog/entry/bt26-05"},{"metric":"third-party-stated","value":"ARMORY CASTLE (formerly UNC5221) exploited CVE-2026-102764 as a zero-day in late August 2026","observer":"Mandiant / Google Threat Intelligence Group","date":"2026-10-15","method":"Mandiant blog 15 Oct 2026. Incident-response evidence. CrowdStrike tracks the same cluster as WARP PANDA, per BeyondTrust.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/"},{"metric":"exposed","value":"more than 1,400","observer":"Shadowserver (via Prophet Security)","date":"2026-10-21","method":"Prophet Security 21 Oct 2026 quoting Shadowserver: more than 1,400 BeyondTrust remote support instances exposed to the internet. No patch-state data. Not a vulnerable or compromise count. Primary Shadowserver page not opened.","sourceUrl":"https://www.prophetsecurity.ai/blog/beyondtrust-remote-support-zero-day"},{"metric":"exposed","value":"9,569","observer":"Censys (via Prophet Security)","date":"2026-10-16","method":"Prophet Security 21 Oct 2026: Censys counted 9,569 internet-facing hosts running Remote Support or Privileged Remote Access on 16 Oct 2026. Versions not visible. Includes PRA. Not a vulnerable count. Primary Censys page not opened.","sourceUrl":"https://www.prophetsecurity.ai/blog/beyondtrust-remote-support-zero-day"}],"seenInTheWildLinks":[{"title":"CISA Known Exploited Vulnerabilities catalog (CVE-2026-102764 listed 16 Oct 2026)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764","observer":"CISA","metric":"exploitation-confirmed"},{"title":"ARMORY CASTLE and BT26-05: What Security Teams Need to Know","url":"https://www.beyondtrust.com/blog/entry/bt26-05","observer":"BeyondTrust","metric":"vendor-stated"},{"title":"ARMORY CASTLE Exploits BeyondTrust","url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","observer":"Mandiant / GTIG","metric":"third-party-stated"}],"whatChanged":{"date":"2026-10-31","items":[{"text":"Rapid7 published an analysis of unauthenticated file upload to remote code execution in BeyondTrust Remote Support (CVE-2026-102764) on 30 Oct 2026. Rapid7 says it confirmed a file write and then code execution as the site user on Remote Support 24.1.2. Other affected releases and fixed builds, Rapid7 says, have not been established in that test. Vendor versions stay on BT26-05.","headline":"Rapid7 published unauthenticated file upload to RCE analysis on 30 Oct 2026","section":"exploitation","date":"2026-10-30","sourceUrl":"https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764/"},{"text":"Jack Heysel opened Metasploit PR 22083 on 30 Oct 2026 at 17:48 UTC: public, unmerged exploit module. The PR says it results in RCE as the site user and was tested on Remote Support 24.1.2; other affected releases and fixed builds have not been established. Index link only.","headline":"Rapid7 opened an unmerged Metasploit PR reporting RCE as site user on 24.1.2","section":"pocs","date":"2026-10-30","sourceUrl":"https://github.com/rapid7/metasploit-framework/pull/22083","alsoSourceUrl":"https://x.com/DailyDarkWeb/status/2116488873878708290"},{"text":"Added Am I affected checks, mitigations and response guidance","headline":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected","date":"2026-10-31","kind":"page"}]},"whatTheBugIs":"CVE-2026-102764 is an authentication bypass by spoofing (CWE-290) in BeyondTrust Remote Support. The NVD record (published 15 Oct 2026 21:17 UTC, lastModified 17 Oct 2026, status Analyzed, checked 31 Oct 2026) says: The vulnerability exists within internal components of BeyondTrust's Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.\n\nBeyondTrust advisory BT26-05 (issue date 15 Oct 2026) uses the same wording, names CWE-290, and scores CVSS 4.0 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). NVD stores that 4.0 metric as Secondary and publishes a Primary CVSS 3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). This page stores the NVD 3.1 9.8 score and keeps the vendor 4.0 9.3 figure dated. NVD also republishes a CISA Coordinator SSVC option exploitation: active dated 16 Oct 2026.\n\nBT26-05 affected table: Remote Support, all versions less than or equal to 26.2.3. Fixed table: BT26-05-RS patch for v24.3.1 through v26.2.3. SaaS Remote Support was patched as of 9 Oct 2026. Self-hosted customers not on automatic updates apply the patch from the /appliance interface. Builds older than 24.3.1 must upgrade before the patch can be applied. Knowledge Base article KB0024066 is listed on the NVD record as Permissions Required (login). The KB HTML was not opened in this pass.\n\nBeyondTrust's 15 Oct 2026 blog (last updated 16 Oct 2026) says a suspected China-nexus actor exploited the issue as a zero-day on 29 Aug 2026 against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. The blog names the actor ARMORY CASTLE (GTIG / Mandiant UNC5221; CrowdStrike WARP PANDA). As of the 16 Oct update, BeyondTrust said it was only aware of those two customers and had not seen evidence of adversary activity since August. The blog also says Remote Support was confirmed vulnerable. Privileged Remote Access shares the affected code; BeyondTrust says internal testing has not identified a way to exploit PRA, but it released a PRA patch out of caution. PRA is not in the BT26-05 impacted-product table. BeyondTrust recommends self-hosted PRA customers apply the released patch.\n\nMandiant (15 Oct 2026) says successful exploitation results in arbitrary file upload, and documents post-exploitation on one appliance: a SAWFLY PHP web shell, a SUID root shell copy, attempts to dump the appliance vault via bt-secrets, startup persistence, Jump Item and Team role changes, and a BARECLAW tunneler. Rapid7 (30 Oct 2026) describes the same CVE as unauthenticated file upload to RCE as the site user on a 24.1.2 lab appliance. This page does not republish request bodies, module options, or exploit steps.\n\nExploitation status: confirmed. CISA listed CVE-2026-102764 in KEV on 16 Oct 2026 (due 19 Oct 2026, knownRansomwareCampaignUse Unknown, forensicTriage Yes). Catalog when checked on 31 Oct 2026: 2026.10.30 (released 2026-10-30T17:02:45.3665Z, 1,766 entries).","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"Internet to Remote Support","detail":"Network access to an affected Remote Support appliance. CISA and BeyondTrust: no credentials named as a requirement."},{"id":"app","label":"Internal message origin accepted","detail":"BT26-05 / NVD: internal components did not adequately validate the origin of received messages. Conceptual impact class only."},{"id":"unsafe","label":"File operations on the appliance","detail":"Vendor and NVD: file operations on the appliance. Mandiant: arbitrary file upload. Rapid7: file write on a 24.1.2 lab host."},{"id":"exec","label":"Code as the site user","detail":"Mandiant: a PHP web shell under the site service account. Rapid7: lab code execution as the site user on 24.1.2."},{"id":"shell","label":"Appliance control and credentials","detail":"Mandiant: privilege to root, vault access attempts, Jump Item or Team role changes, and downstream support sessions."}]},"exploitation":{"kev":{"listed":true,"date":"2026-10-16","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV catalog 2026.10.30 (released 2026-10-30T17:02:45.3665Z, 1,766 entries), checked 31 Oct 2026. CVE-2026-102764 dateAdded 2026-10-16, dueDate 2026-10-19, knownRansomwareCampaignUse Unknown, forensicTriage Yes. CISA vulnerability name: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability."},"firstSeen":{"date":"2026-08-29","source":"BeyondTrust BT26-05 blog and Mandiant ARMORY CASTLE write-up","note":"BeyondTrust (15 Oct 2026, updated 16 Oct): the actor exploited a zero-day on 29 Aug 2026 against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. Mandiant (15 Oct 2026): ARMORY CASTLE exploited this CVE as a zero-day in late August 2026. CISA listed the CVE in KEV on 16 Oct 2026. First calendar day of successful compromise is the vendor-stated 29 Aug 2026 date."},"vendorStatements":[{"vendor":"BeyondTrust (BT26-05)","date":"2026-10-15","statement":"BeyondTrust has remediated a critical vulnerability in Remote Support (RS) that could allow a remote attacker to perform file operations on an affected appliance. The vulnerability exists within internal components of Remote Support. The components did not adequately validate the origin of the messages it received. Affected: Remote Support, all versions <= 26.2.3. Fixed: BT26-05-RS patch for (v24.3.1 - v26.2.3). As of Oct 9, 2026, a patch has been applied to all Remote Support SaaS customers. CWE-290. CVSS 4.0 9.3.","url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","retracted":false},{"vendor":"BeyondTrust (blog)","date":"2026-10-16","statement":"A suspected China-nexus espionage actor exploited a zero-day vulnerability. August 29, 2026: The actor exploited a zero-day vulnerability against a single BeyondTrust-hosted Remote Support instance and a single self-hosted Remote Support appliance. As of the last update we are only aware of the two impacted customers mentioned above, and have not seen evidence of adversary activity since August. Remote Support was confirmed to be vulnerable to this CVE. While our internal testing has not identified any way for an attacker to exploit this vulnerability in Privileged Remote Access, PRA shares the affected code, so out of an abundance of caution, we have released the patch for PRA.","url":"https://www.beyondtrust.com/blog/entry/bt26-05","retracted":false},{"vendor":"CISA","date":"2026-10-16","statement":"CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on Oct. 16, 2026. Due 19 Oct 2026. knownRansomwareCampaignUse Unknown. forensicTriage Yes.","url":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support","retracted":false},{"vendor":"Mandiant / GTIG","date":"2026-10-15","statement":"The successful exploitation of this vulnerability results in the arbitrary upload of files. During an incident response engagement, Mandiant identified evidence that ARMORY CASTLE, a suspected PRC-nexus espionage threat actor (formerly tracked as UNC5221), exploited this vulnerability as a zero-day, in late August 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","retracted":false}]},"timeline":[{"date":"2026-08-29","event":"BeyondTrust: the actor exploited a zero-day against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. Mandiant later attributed the activity to ARMORY CASTLE (UNC5221).","source":{"title":"ARMORY CASTLE and BT26-05: What Security Teams Need to Know","url":"https://www.beyondtrust.com/blog/entry/bt26-05","publisher":"BeyondTrust"},"kind":"exploited","key":true,"addedDate":"2026-10-31"},{"date":"2026-09-28","event":"BeyondTrust: Cyber Defense hunting found the SaaS customer event and contained the instance within 27 minutes of first detection. Product Security reproduced the entry vector the same day.","source":{"title":"ARMORY CASTLE and BT26-05: What Security Teams Need to Know","url":"https://www.beyondtrust.com/blog/entry/bt26-05","publisher":"BeyondTrust"},"kind":"vendor","addedDate":"2026-10-31"},{"date":"2026-09-30","event":"BeyondTrust: Mandiant shared findings from the self-hosted customer that confirmed what BeyondTrust found on 28 Sep 2026.","source":{"title":"ARMORY CASTLE and BT26-05: What Security Teams Need to Know","url":"https://www.beyondtrust.com/blog/entry/bt26-05","publisher":"BeyondTrust"},"kind":"vendor","addedDate":"2026-10-31"},{"date":"2026-10-08","event":"BeyondTrust released the BT26-05 patch to SaaS and self-hosted customers. SaaS Remote Support and Privileged Remote Access instances were automatically patched.","source":{"title":"ARMORY CASTLE and BT26-05: What Security Teams Need to Know","url":"https://www.beyondtrust.com/blog/entry/bt26-05","publisher":"BeyondTrust"},"kind":"patch","key":true,"addedDate":"2026-10-31"},{"date":"2026-10-09","event":"BT26-05: as of 9 Oct 2026, a patch that remediates this vulnerability had been applied to all Remote Support SaaS customers.","source":{"title":"BT26-05","url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","publisher":"BeyondTrust"},"kind":"patch","addedDate":"2026-10-31"},{"date":"2026-10-15","event":"BeyondTrust published advisory BT26-05 and the ARMORY CASTLE blog. Affected: Remote Support all versions <= 26.2.3. Fixed: BT26-05-RS for 24.3.1 through 26.2.3. CVSS 4.0 9.3. CWE-290.","source":{"title":"BT26-05","url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","publisher":"BeyondTrust"},"kind":"advisory","key":true,"addedDate":"2026-10-31"},{"date":"2026-10-15","event":"Mandiant published ARMORY CASTLE Exploits BeyondTrust: zero-day file upload, SAWFLY web shell, BARECLAW tunneler, hashes, and YARA.","source":{"title":"ARMORY CASTLE Exploits BeyondTrust","url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","publisher":"Mandiant / Google Threat Intelligence Group"},"kind":"advisory","key":true,"addedDate":"2026-10-31"},{"date":"2026-10-15T21:17:00.117Z","event":"NVD published CVE-2026-102764 at 21:17 UTC. Status when opened on 31 Oct 2026: Analyzed. Primary metric is NVD CVSS 3.1 9.8. CNA BeyondTrust metric is CVSS 4.0 9.3.","source":{"title":"NVD - CVE-2026-102764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102764","publisher":"NVD"},"kind":"disclosure","addedDate":"2026-10-31"},{"date":"2026-10-16","event":"CISA added CVE-2026-102764 to KEV (due 19 Oct 2026, knownRansomwareCampaignUse Unknown, forensicTriage Yes) and published an alert urging self-hosted customers to apply BT26-05-RS.","source":{"title":"CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support","url":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support","publisher":"CISA"},"kind":"kev","key":true,"addedDate":"2026-10-31"},{"date":"2026-10-16","event":"Canadian Centre for Cyber Security published AL26-025 covering CVE-2026-102764. Fixed versions: BT26-05-RS for 24.3.1 through 26.2.3. Notes open-source reporting of in-the-wild use.","source":{"title":"AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support","url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764","publisher":"Canadian Centre for Cyber Security"},"kind":"advisory","addedDate":"2026-10-31"},{"date":"2026-10-17T04:16:47.117Z","event":"NVD last modified CVE-2026-102764 (04:16 UTC). Status Analyzed. Primary CVSS 3.1 9.8. CISA Coordinator SSVC option exploitation: active is dated 16 Oct 2026.","source":{"title":"NVD - CVE-2026-102764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102764","publisher":"NVD"},"kind":"disclosure","addedDate":"2026-10-31"},{"date":"2026-10-30","event":"Rapid7 published an analysis: unauthenticated file upload to RCE as the site user, tested on Remote Support 24.1.2. Rapid7 says other affected releases and fixed builds have not been established in that test.","source":{"title":"Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)","url":"https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764/","publisher":"Rapid7"},"kind":"advisory","key":true,"addedDate":"2026-10-31"},{"date":"2026-10-30T17:48:27Z","event":"jheysel-r7 opened Metasploit PR 22083 (still open/unmerged when checked 31 Oct 2026): public module for unauthenticated file upload resulting in RCE as the site user, tested on Remote Support 24.1.2.","source":{"title":"BeyondTrust Remote Support File Upload (CVE-2026-102764)","url":"https://github.com/rapid7/metasploit-framework/pull/22083","publisher":"Rapid7 / Metasploit"},"kind":"poc","addedDate":"2026-10-31"},{"date":"2026-10-31T11:14:04Z","event":"DailyDarkWeb posted a public lead on the Rapid7 analysis and the still-unmerged Metasploit PR. Credit only.","source":{"title":"DailyDarkWeb status 2116488873878708290","url":"https://x.com/DailyDarkWeb/status/2116488873878708290","publisher":"DailyDarkWeb"},"kind":"other","addedDate":"2026-10-31"}],"openNotes":[{"title":"KB0024066 HTML was not opened","detail":"NVD lists https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066 as Permissions Required. Affected and fixed versions on this page come from the public BT26-05 advisory table, not from the KB. Extra version rows that appear only behind login: not verified.","sources":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102764","date":"2026-10-17","publisher":"NVD"},{"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","date":"2026-10-15","publisher":"BeyondTrust"}]},{"title":"Privileged Remote Access is not in the BT26-05 impacted-product table","detail":"The public advisory lists Impacted Product: Remote Support (RS) only. The 16 Oct 2026 blog says PRA shares the affected code, internal testing has not identified a way to exploit PRA, a PRA patch was still released, and self-hosted PRA customers should apply it. Cyber Centre AL26-025 says PRA SaaS was patched as of 9 Oct 2026.","sources":[{"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","date":"2026-10-15","publisher":"BeyondTrust"},{"url":"https://www.beyondtrust.com/blog/entry/bt26-05","date":"2026-10-16","publisher":"BeyondTrust"},{"url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764","date":"2026-10-16","publisher":"Canadian Centre for Cyber Security"}]},{"title":"Rapid7 lab versions versus the vendor table","detail":"Rapid7 (30 Oct 2026) and Metasploit PR 22083 say they tested Remote Support 24.1.2 and that other affected releases and fixed builds have not been established in that test. BT26-05 already names all versions <= 26.2.3 as affected and BT26-05-RS for 24.3.1 through 26.2.3 as the fix. 24.1.2 is older than 24.3.1, so the vendor path is upgrade first, then the patch. This page keeps the vendor table for versions.","sources":[{"url":"https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764/","date":"2026-10-30","publisher":"Rapid7"},{"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","date":"2026-10-15","publisher":"BeyondTrust"}]}],"defenderActions":[{"title":"Inventory every Remote Support appliance and whether it is SaaS or self-hosted","detail":"Record product, version from /appliance, and whether untrusted networks can reach the customer portal or administrative paths. SaaS tenants were patched 9 Oct 2026. Self-hosted 24.3.1 through 26.2.3 need BT26-05-RS. Older than 24.3.1 must upgrade first.","priority":"now","links":[{"label":"BT26-05 advisory","href":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05"}]},{"title":"Apply BT26-05-RS, or upgrade first if the build is older than 24.3.1","detail":"Vendor: apply the patch from /appliance, or confirm automatic updates applied it. Builds older than 24.3.1 cannot take the patch until they are upgraded. A patch does not clear prior exposure. Mandiant: treat an appliance that was reachable while vulnerable as potentially compromised until reviewed.","priority":"now","links":[{"label":"BT26-05 advisory","href":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05"},{"label":"Mandiant ARMORY CASTLE write-up","href":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/"}]},{"title":"Restrict administrative interfaces and keep logs off the appliance","detail":"BeyondTrust and CISA: expose only the services users need; restrict /login and /appliance to trusted networks. Forward syslog and session events off-box. This actor deleted local logs on the appliance Mandiant reviewed.","priority":"now","links":[{"label":"BeyondTrust BT26-05 blog","href":"https://www.beyondtrust.com/blog/entry/bt26-05"},{"label":"CISA alert","href":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support"}]},{"title":"Hunt Mandiant artefacts and role changes if the appliance was reachable from 29 Aug 2026","detail":"Review off-box syslog, reverse-proxy or WAF, and firewall logs for mangoapi.php, app_84304470, /uidchanarge, Jump Item or Team role raises, and gaps in log forwarding. Host paths need a forensic image or BeyondTrust support. Do not send crafted requests.","priority":"now","links":[{"label":"Mandiant ARMORY CASTLE write-up","href":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/"}]},{"title":"Apply the vendor PRA patch on self-hosted Privileged Remote Access","detail":"BeyondTrust: internal testing has not identified a PRA exploit path. PRA shares the affected code, so a PRA patch was still released. BeyondTrust recommends self-hosted PRA customers apply it. Cyber Centre AL26-025: PRA SaaS was patched by 9 Oct 2026.","priority":"now","links":[{"label":"BeyondTrust BT26-05 blog","href":"https://www.beyondtrust.com/blog/entry/bt26-05"},{"label":"Cyber Centre AL26-025","href":"https://www.cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764"}]}],"detection":[{"title":"Unknown PHP paths and /uidchanarge on the reverse proxy or WAF","detail":"Mandiant: ARMORY CASTLE posted to /app_84304470%2Ephp, then created SAWFLY at mangoapi.php under the site web root. The tunneler used WebSocket path /uidchanarge. Hunt reverse-proxy or WAF logs for those paths and for .php paths the appliance does not normally serve. A hit is a lead, not proof by itself. BeyondTrust says this actor rotates tooling.","logSource":"Reverse-proxy / WAF / HTTP access logs in front of Remote Support","kind":"generic","group":"web-proxy","url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15"},{"title":"user_changed events that raise Jump Item or Team roles","detail":"Mandiant recovered a syslog user_changed event that raised Jump Item and Team permissions from No Access to Administrator. BeyondTrust and CISA also name unauthorized account, permission, or session-policy changes. Review forwarded appliance syslog, not only the box.","logSource":"BeyondTrust appliance syslog (forwarded off-box)","kind":"generic","url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15"},{"title":"Administrative /login from unexpected networks","detail":"BeyondTrust and Mandiant: unrecognized privileged or administrative sessions from residential broadband or commercial VPN addresses that you cannot tie to a known administrator or ticket. Presence of a login is not proof of this CVE.","logSource":"BeyondTrust appliance syslog for /login (forwarded off-box)","kind":"generic","url":"https://www.beyondtrust.com/blog/entry/bt26-05","date":"2026-10-16"},{"title":"Gaps in syslog forwarding bounded by a single session","detail":"Mandiant calls an interruption in syslog forwarding that starts and ends inside a single session a strong indicator of log tampering. BeyondTrust: this actor deletes local logs. Off-box copies are often the only record.","logSource":"SIEM receipt of appliance syslog / session events","kind":"generic","url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15"},{"title":"thin-scc, brain, access, messages, and SSL logs on a forensic image","detail":"Mandiant found exploitation evidence in access, syslog, messages, thin-scc, brain, and SSL logs on the LUKS-encrypted /home partition. Customers cannot read that partition on their own. Request preservation through BeyondTrust Support, or review a forensic image. Rapid7 later named thin-scc LocalFileTransfer and brain customer-session lines in a lab; those lab strings are researcher-reported, not an in-the-wild IOC list.","logSource":"Forensic image of the appliance /home partition (LUKS), or BeyondTrust Support export","kind":"generic","url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15"},{"title":"Host artefacts: SAWFLY, SUID copy, startup script, BARECLAW","detail":"Mandiant names mangoapi.php under the site web root, /usr/bin/dbus-authd as a copied SUID shell, /home/bomgar/sbin/post_boot.d/zz-root-persist, /tmp/ingredi_ws, and HAProxy edits for /uidchanarge. Host inspection needs a forensic image or vendor support. BeyondTrust: indicators from one victim rarely reappear.","logSource":"Forensic image / BeyondTrust Support host review","kind":"generic","group":"edr","url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15"}],"detectionRules":[{"id":"v2s-sigma-beyondtrust-rs-itw-paths","title":"BeyondTrust RS Mandiant ITW web paths","language":"sigma","query":"title: BeyondTrust RS Mandiant ITW web paths (CVE-2026-102764 hunt)\nid: 9e4c2b71-6a0d-4f18-b3c1-2f8d0a91c6e4\nstatus: experimental\ndescription: Detects HTTP requests to web paths Mandiant named from one ARMORY CASTLE intrusion against BeyondTrust Remote Support. Path hunt only. Not a payload detector. Actor tooling rotates.\nreferences:\n    - https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-102764\nauthor: vuln2shell\ndate: 2026-10-31\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-uri-stem|contains:\n            - 'mangoapi.php'\n            - 'app_84304470'\n            - '/uidchanarge'\n    condition: selection\nfalsepositives:\n    - Unlikely on an unmodified Remote Support portal\nlevel: high","logSource":"Reverse-proxy / WAF / HTTP access logs in front of Remote Support","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15","license":"CC0 1.0","origin":"vuln2shell","notes":"Hunting query from Mandiant-named paths. A request is not proof of compromise. Tune field names to your shipper.","tested":"untested"},{"id":"v2s-spl-beyondtrust-rs-itw-paths","title":"BeyondTrust RS Mandiant ITW web paths (SPL)","language":"spl","query":"index=* (sourcetype=access_combined OR sourcetype=nginx:plus:access OR sourcetype=aws:waf:logs OR sourcetype=syslog)\n(\"mangoapi.php\" OR \"mangoapi\" OR \"app_84304470\" OR \"/uidchanarge\" OR \"user_changed\")\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, sourcetype\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Reverse-proxy / WAF / forwarded appliance syslog","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15","license":"CC0 1.0","origin":"vuln2shell","notes":"Path and event-name hunt. Tune sourcetype. user_changed alone is noisy; keep rows that also raise Jump Item or Team roles.","tested":"untested"},{"id":"v2s-kql-beyondtrust-rs-itw-paths","title":"BeyondTrust RS Mandiant ITW web paths (KQL)","language":"kql","query":"union isfuzzy=true CommonSecurityLog, W3CIISLog, Syslog\n| where TimeGenerated > ago(14d)\n| where * has_any (\"mangoapi.php\", \"app_84304470\", \"/uidchanarge\")\n| summarize count(), min(TimeGenerated), max(TimeGenerated) by Computer, Type\n| order by count_ desc","logSource":"Reverse-proxy / WAF / syslog shipped to Microsoft Sentinel","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15","license":"CC0 1.0","origin":"vuln2shell","notes":"Table and field names vary by parser. Map to your reverse-proxy or syslog ingestion.","tested":"untested"},{"id":"v2s-esql-beyondtrust-rs-itw-paths","title":"BeyondTrust RS Mandiant ITW web paths (ES|QL)","language":"esql","query":"FROM logs-*\n| WHERE url.path LIKE \"*mangoapi*\" OR url.path LIKE \"*app_84304470*\" OR url.path LIKE \"*uidchanarge*\" OR message LIKE \"*mangoapi.php*\"\n| STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name, source.ip","logSource":"Reverse-proxy / WAF / syslog shipped to Elastic","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. Index and field names vary by ingest pipeline.","tested":"untested"},{"id":"v2s-suricata-beyondtrust-rs-itw-paths","title":"BeyondTrust RS Mandiant ITW web paths (Suricata)","language":"suricata","query":"alert http any any -> any any (msg:\"VULN2SHELL BeyondTrust RS Mandiant ITW path CVE-2026-102764\"; flow:established,to_server; http.uri; pcre:\"/mangoapi|app_84304470|uidchanarge/i\"; classtype:web-application-attack; sid:1102764; rev:1;)","logSource":"IDS / IPS in front of Remote Support","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15","license":"CC0 1.0","origin":"vuln2shell","notes":"Local sid 1102764. Path hunt from Mandiant-named URIs. Not a payload detector.","tested":"untested"},{"id":"gtig-yara-sawfly","title":"G_Hunting_Webshell_SAWFLY_1","language":"yara","query":"rule G_Hunting_Webshell_SAWFLY_1 {\n  meta:\n    author = \"Google Threat Intelligence Group\"\n  strings:\n    $b32 = \"ABCDEFGHIJKLMNOPQRSTUVWXYZ234567\" ascii wide\n    $rc4 = \"range(0,255)\" ascii wide\n    $pack = \"pack('H*',\" ascii wide\n    $eval = \"@eval(\" ascii wide\n    $code404 = \"http_response_code(404)\" ascii wide\n  condition:\n    filesize < 20KB and\n    all of them\n}","logSource":"Forensic image or file scan of the site web root","author":"Google Threat Intelligence Group","authorUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15","origin":"community","notes":"Published by GTIG on 15 Oct 2026 for the SAWFLY web shell from one intrusion. Actor tooling rotates. Listed for defenders. This site does not add exploit content.","tested":"untested"},{"id":"gtig-yara-bareclaw","title":"G_Hunting_Backdoor_BARECLAW_1","language":"yara","query":"rule G_Hunting_Backdoor_BARECLAW_1 {\n  meta:\n    author = \"Google Threat Intelligence Group\"\n  strings:\n    $s1 = \"[%s ws_socks5d] \" ascii wide\n    $s2 = \"--obfs requires --token\" ascii wide\n    $s3 = \"mux: %s (frame[%lu]: %s)\" ascii wide\n    $s4 = \"cannot create stream pump/writer thread (stream %d)\" ascii wide\n    $s5 = \"reject: bad or missing token from %s\" ascii wide\n    $s6 = \"listening on %s path=%s (token=%s obfs=%s max_tunnels=%d threads=%d)\" ascii wide\n    $s7 = \"--ws-path must start with '/'\" ascii wide\n    $b_xorshift = { 48 c1 e0 17 48 31 c1 48 89 f0 48 c1 e8 1a 48 31 f0 48 31 c8 48 c1 e9 11 48 31 c8 }\n  condition:\n    uint32(0) == 0x464c457f and (5 of ($s*)) or ($b_xorshift and (3 of ($s*)))\n}","logSource":"Forensic image or file scan of the appliance host","author":"Google Threat Intelligence Group","authorUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15","origin":"community","notes":"Published by GTIG on 15 Oct 2026 for the BARECLAW tunneler from one intrusion. Actor tooling rotates.","tested":"untested"}],"detectionLinks":[{"title":"Mandiant ARMORY CASTLE Exploits BeyondTrust (IOCs and YARA)","url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","author":"Mandiant / Google Threat Intelligence Group","date":"2026-10-15","note":"Public analysis, hashes, and YARA for defenders. This site does not republish exploit code."},{"title":"BeyondTrust BT26-05 blog (hunt behaviour)","url":"https://www.beyondtrust.com/blog/entry/bt26-05","author":"BeyondTrust Security Team","date":"2026-10-16","note":"Vendor hunt list: unexpected admin sessions, web-directory scripts, Jump Item or Team changes, log-forwarding gaps."},{"title":"Rapid7 analysis (lab detection notes)","url":"https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764/","author":"Jack Heysel, Rapid7","date":"2026-10-30","note":"Lab write-up. Detection pointers only. This site does not republish module usage."}],"retrohunt":{"summary":"If a Remote Support appliance was reachable from 29 Aug 2026, hunt off-box proxy, WAF, firewall, and syslog for Mandiant-named paths, Jump Item or Team role raises, and gaps in log forwarding. Host artefacts need a forensic image or BeyondTrust Support.","lookback":{"from":"2026-08-29","basis":"first-exploitation","rationale":"BeyondTrust dates both known victims to 29 Aug 2026. Mandiant dates the same actor's zero-day use to late August 2026. Public disclosure was 15 Oct 2026. Hunt from the vendor-stated first-use day.","sources":[{"url":"https://www.beyondtrust.com/blog/entry/bt26-05","date":"2026-10-16","publisher":"BeyondTrust"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15","publisher":"Mandiant / GTIG"}]},"logSources":[{"name":"Reverse-proxy / WAF / perimeter firewall logs","why":"Mandiant and CISA: keep request-path and reachability records the appliance cannot alter. Hunt mangoapi.php, app_84304470, /uidchanarge, and unknown .php paths.","required":true},{"name":"Forwarded appliance syslog and session events","why":"BeyondTrust: this actor deletes local logs. Hunt user_changed role raises, unexpected /login, file-transfer events, and gaps in forwarding.","required":true},{"name":"Forensic image of /home (LUKS) or BeyondTrust Support export","why":"Mandiant found exploitation evidence in access, syslog, messages, thin-scc, brain, and SSL logs on that partition. Customers cannot read it on their own.","required":false}],"steps":[{"title":"List mangoapi.php, app_84304470, and /uidchanarge since 29 Aug 2026","detail":"Search reverse-proxy, WAF, or HTTP access logs for those Mandiant-named paths. A request is a lead, not proof. Do not send crafted requests.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15","publisher":"Mandiant / GTIG"}]},{"title":"Review forwarded syslog for role changes and log gaps","detail":"Mandiant: user_changed events that raise Jump Item or Team roles from No Access to Administrator. Also hunt unexpected /login and interruptions in syslog forwarding bounded by a single session.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15","publisher":"Mandiant / GTIG"},{"url":"https://www.beyondtrust.com/blog/entry/bt26-05","date":"2026-10-16","publisher":"BeyondTrust"}]},{"title":"If you have a forensic image, review Mandiant host artefacts","detail":"Look for mangoapi.php under the site web root, /usr/bin/dbus-authd, /home/bomgar/sbin/post_boot.d/zz-root-persist, /tmp/ingredi_ws, and HAProxy edits for /uidchanarge. Request BeyondTrust Support if you cannot read the encrypted partition.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15","publisher":"Mandiant / GTIG"}]}],"queries":[{"id":"v2s-spl-beyondtrust-rs-retrohunt","title":"BeyondTrust RS Mandiant paths since 29 Aug 2026","language":"spl","query":"index=* (\"mangoapi.php\" OR \"app_84304470\" OR \"/uidchanarge\" OR \"zz-root-persist\" OR \"ingredi_ws\") earliest=08/29/2026:00:00:00\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, sourcetype\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Reverse-proxy / WAF / forwarded appliance syslog","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15","license":"CC0 1.0","origin":"vuln2shell","notes":"Lookback from the vendor-stated first-use day. Tune sourcetype.","tested":"untested","timeRange":"From 29 Aug 2026 (BeyondTrust first-use date) through the last patch window"}],"artefacts":[{"kind":"web-log","value":"mangoapi.php","detail":"Mandiant: SAWFLY web shell name from one intrusion. Actor tooling rotates.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"kind":"web-log","value":"/app_84304470%2Ephp","detail":"Mandiant: staging web-shell path. File was not recovered.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"kind":"web-log","value":"/uidchanarge","detail":"Mandiant: BARECLAW WebSocket path used on the reviewed appliance. Default path named by Mandiant is /wsproxy.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"kind":"file","value":"/usr/bin/dbus-authd","detail":"Mandiant: copied system shell with SUID root from one intrusion.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"kind":"file","value":"/home/bomgar/sbin/post_boot.d/zz-root-persist","detail":"Mandiant: startup script that grants passwordless root to the site service account and rebuilds sudoers.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"kind":"file","value":"/tmp/ingredi_ws","detail":"Mandiant: BARECLAW tunneler filename from one intrusion. Listen port 19800 on that host.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"kind":"account","value":"Jump Item or Team role raised to Administrator","detail":"Mandiant recovered a user_changed syslog event that raised those roles from No Access to Administrator.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"}],"iocs":[{"type":"hash","value":"dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb","context":"SHA-256 for mangoapi.php (SAWFLY) from one Mandiant intrusion. Actor tooling rotates.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"type":"hash","value":"1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462","context":"SHA-256 for ingredi_ws (BARECLAW) from one Mandiant intrusion. Actor tooling rotates.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"type":"filename","value":"mangoapi.php","context":"SAWFLY web shell filename from one Mandiant intrusion.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"type":"path","value":"/usr/bin/dbus-authd","context":"Copied SUID shell from one Mandiant intrusion.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"type":"path","value":"/home/bomgar/sbin/post_boot.d/zz-root-persist","context":"Startup persistence script from one Mandiant intrusion.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"type":"url","value":"/uidchanarge","context":"BARECLAW WebSocket path from one Mandiant intrusion.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"}],"iocNote":"Mandiant published two SHA-256 hashes and the filenames above from one intrusion on 15 Oct 2026. BeyondTrust says this actor rotates infrastructure and tooling, so indicators from one victim rarely reappear. No published attacker IPs from a source we opened. Rapid7 lab canary paths are not indexed as in-the-wild IOCs.","hitMeaning":[{"level":"attempt","detail":"A request to a Mandiant-named path or an unexpected /login, with no matching role change, host artefact, or log-forwarding gap."},{"level":"likely-compromise","detail":"Those paths plus a Jump Item or Team role raise, a syslog-forwarding gap bounded by one session, or a Mandiant-named host artefact on an appliance that was reachable from 29 Aug 2026."},{"level":"compromise","detail":"Vendor-confirmed intrusion, or recovered SAWFLY / BARECLAW / SUID copy / startup script on the appliance. BeyondTrust asks customers with evidence to open a Sev 1 case that cites BT26-05.","label":"Compromise (your evidence)"}],"nextSteps":[{"title":"Preserve the appliance, then patch or rebuild","detail":"CISA and Mandiant: snapshot virtual appliances with memory, or request forensic preservation for hardware and SaaS, before isolate or rebuild. Then apply BT26-05-RS or rebuild from a clean patched image.","links":[{"label":"CISA alert","href":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support"},{"label":"Mandiant ARMORY CASTLE write-up","href":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/"}]},{"title":"Rotate every credential the appliance stored or injected","detail":"BeyondTrust and CISA: if you find exploitation evidence, treat stored and injected credentials as exposed. Rotate after the appliance is patched or rebuilt, not before.","links":[{"label":"BeyondTrust BT26-05 blog","href":"https://www.beyondtrust.com/blog/entry/bt26-05"}]}],"limits":["Mandiant IOCs are from one intrusion. BeyondTrust says this actor rotates tooling.","No published attacker IPs from a source we opened.","Customers cannot read the LUKS /home logs without vendor support or a forensic image.","Rapid7 lab strings are researcher-reported, not an in-the-wild IOC list."],"sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15","publisher":"Mandiant / GTIG"},{"url":"https://www.beyondtrust.com/blog/entry/bt26-05","date":"2026-10-16","publisher":"BeyondTrust"},{"url":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support","date":"2026-10-16","publisher":"CISA"}],"updatedAt":"2026-10-31"},"amIAffected":{"summary":"BeyondTrust names all Remote Support versions less than or equal to 26.2.3 as affected. The fix is the BT26-05-RS patch on 24.3.1 through 26.2.3. Older than 24.3.1 must upgrade first. SaaS was patched 9 Oct 2026. Privileged Remote Access is not in the BT26-05 impacted-product table. The blog says a PRA patch was still released and self-hosted PRA customers should apply it. KB0024066 was not opened (login).","checks":[{"id":"v2s-aia-beyondtrust-rs-cve-2026-102764-version-1","kind":"version","title":"Record the Remote Support version from /appliance against BT26-05","detail":"BT26-05: all versions <= 26.2.3 are affected. The patch applies to 24.3.1 through 26.2.3. No public CLI version string was copied from the advisory in this pass. Use the /appliance version display. Do not send crafted requests.","command":"Record the installed BeyondTrust Remote Support version from the /appliance interface and compare it to BT26-05 (affected: all versions <= 26.2.3; patch: BT26-05-RS on 24.3.1 through 26.2.3; older than 24.3.1 must upgrade first).","affectedMeans":"The installed version is 26.2.3 or earlier and BT26-05-RS is not applied (or the build is older than 24.3.1 and has not been upgraded).","fixedMeans":"BT26-05-RS is applied on a 24.3.1 through 26.2.3 build, or the instance is BeyondTrust-hosted SaaS patched on 9 Oct 2026.","notes":"This is inventory only. KB0024066 was not opened. Rapid7 tested 24.1.2 in a lab; that build is older than 24.3.1.","sources":[{"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","date":"2026-10-15","publisher":"BeyondTrust"}]},{"id":"v2s-aia-beyondtrust-rs-cve-2026-102764-config-2","kind":"config","title":"Record whether the instance is BeyondTrust-hosted SaaS or self-hosted","detail":"BT26-05: SaaS Remote Support was patched as of 9 Oct 2026. Self-hosted customers apply BT26-05-RS from /appliance unless automatic updates already applied it. Record hosting model on every instance.","command":"On each Remote Support instance, record whether it is BeyondTrust-hosted SaaS or self-hosted, and whether /appliance shows BT26-05-RS applied.","affectedMeans":"Self-hosted, version 26.2.3 or earlier, and BT26-05-RS is not applied.","fixedMeans":"BeyondTrust-hosted SaaS (vendor-managed, patched 9 Oct 2026), or self-hosted with BT26-05-RS applied (after upgrade if older than 24.3.1).","notes":"SaaS credential review still applies if the tenant was in use during the August window. Mandiant: patching does not remove prior host persistence.","sources":[{"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","date":"2026-10-15","publisher":"BeyondTrust"}]},{"id":"v2s-aia-beyondtrust-rs-cve-2026-102764-config-3","kind":"config","title":"Record whether untrusted networks can reach the appliance","detail":"CISA and BeyondTrust: limit external access to the services users need and restrict administrative interfaces to trusted networks. Record reachability of the customer portal and of /login and /appliance. Do not probe the bug.","command":"On each Remote Support appliance, record whether untrusted networks can complete HTTPS connections to the customer portal, /login, or /appliance.","affectedMeans":"An untrusted network can reach a self-hosted 26.2.3-or-earlier appliance that is missing BT26-05-RS.","fixedMeans":"Administrative paths are restricted to trusted networks and BT26-05-RS is applied, or the instance is SaaS patched on 9 Oct 2026.","notes":"Reachability is a precondition, not proof of compromise. Mandiant: any appliance reachable while vulnerable should be treated as potentially compromised until reviewed.","sources":[{"url":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support","date":"2026-10-16","publisher":"CISA"},{"url":"https://www.beyondtrust.com/blog/entry/bt26-05","date":"2026-10-16","publisher":"BeyondTrust"}]},{"id":"v2s-aia-beyondtrust-rs-cve-2026-102764-exposure-4","kind":"exposure","title":"Scoped product-fingerprint search for your own ranges","detail":"A 26 Oct 2026 ZoomEye note used app=\"Bomgar\" as a product fingerprint (2,185 assets globally that day). That is not a vulnerable count. No sourced Shodan query was opened for this CVE. Scope any search to your estate.","command":"zoomeye search 'app=\"Bomgar\" && (cidr=\"<your-range>\" || org=\"<your org>\")'","affectedMeans":"A host in your range matches the Bomgar product fingerprint and is a self-hosted Remote Support appliance on 26.2.3 or earlier without BT26-05-RS.","fixedMeans":"No matching self-hosted appliance in your range, or every match is SaaS or already shows BT26-05-RS.","notes":"Fingerprint only. Prophet Security (21 Oct 2026) quoted Shadowserver (more than 1,400) and Censys (9,569 RS or PRA on 16 Oct 2026). Those pages were not opened. Do not treat a banner hit as proof of this CVE.","sources":[{"url":"https://dev.to/kozhevniko/counting-the-boxes-a-2185-asset-inventory-of-beyondtrust-remote-support-edge-appliances-22f5","date":"2026-10-26","publisher":"DEV Community"}]}],"limits":["KB0024066 was not opened (NVD: Permissions Required).","No sourced Shodan fingerprint for this CVE. Do not invent one.","No public CLI version string was copied from BT26-05.","Privileged Remote Access is not in the BT26-05 impacted-product table."],"sources":[{"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","date":"2026-10-15","publisher":"BeyondTrust"},{"url":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support","date":"2026-10-16","publisher":"CISA"}],"updatedAt":"2026-10-31","addedDate":"2026-10-31"},"mitigations":{"summary":"BeyondTrust, CISA, and Mandiant document network-restriction and off-box logging workarounds until BT26-05-RS is installed. They do not replace the patch. SaaS was already patched 9 Oct 2026.","items":[{"title":"Restrict administrative interfaces and unused inbound paths","detail":"BeyondTrust and CISA: expose only the parts of the appliance that users need. Restrict /login and /appliance to trusted networks. Mandiant: only representative console, customer portal, and Jump Client traffic should be reachable from the internet where that is operationally possible.","limits":"Not a software fix. Still apply BT26-05-RS. Internal paths remain in scope if an attacker can reach the appliance from another segment. Isolation at /appliance can destroy evidence; CISA and Mandiant prefer a perimeter block when compromise is suspected.","verify":"Untrusted networks can no longer complete an HTTPS connection to /login or /appliance. Confirm in the edge firewall or appliance ACL, then re-check after the next change window. Do not send crafted requests.","source":{"url":"https://www.beyondtrust.com/blog/entry/bt26-05","date":"2026-10-16","publisher":"BeyondTrust"}},{"title":"Forward appliance syslog and session events off the box","detail":"BeyondTrust: forward syslog and session events to your SIEM in near real time. This actor deletes local logs, and off-box copies are often the only record left. CISA repeats the same step.","limits":"Not a software fix. Forwarding after a gap does not recover deleted local logs. Still apply BT26-05-RS.","verify":"The SIEM is receiving appliance syslog and session events with no unexpected gaps. Confirm a test event after the next change window.","source":{"url":"https://www.beyondtrust.com/blog/entry/bt26-05","date":"2026-10-16","publisher":"BeyondTrust"}}],"updatedAt":"2026-10-31","addedDate":"2026-10-31"},"response":{"summary":"If a self-hosted appliance was reachable while vulnerable, preserve it, isolate at the perimeter, then patch or rebuild and rotate stored credentials. Mandiant published host artefacts from one intrusion; BeyondTrust says this actor rotates tooling.","containment":[{"title":"Preserve evidence before changing the appliance","detail":"CISA and Mandiant: snapshot virtual appliances with memory, or collect a forensic image for hardware. For B Series and SaaS, request forensic preservation through BeyondTrust Support. Immediately forward remaining syslog and collect reverse-proxy, WAF, and firewall logs for the exposure window.","sources":[{"url":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support","date":"2026-10-16","publisher":"CISA"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15","publisher":"Mandiant / GTIG"}]},{"title":"Isolate a suspected appliance at the perimeter","detail":"Mandiant: block inbound traffic to the public address at the firewall rather than in /appliance, so the configuration stays intact. Restrict egress except to BeyondTrust update and licensing endpoints. End active support sessions and disable new sessions, Jump Clients, Jumpoints, and API accounts from /login (disable rather than delete).","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15","publisher":"Mandiant / GTIG"}]},{"title":"Apply BT26-05-RS or rebuild from a clean patched image","detail":"CISA: rebuild from a known-good state and apply BT26-05-RS. Mandiant: customers cannot audit the appliance host file system, and host-level persistence survives reboot and configuration reset. Restore only a configuration backup dated before the exposure window.","sources":[{"url":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support","date":"2026-10-16","publisher":"CISA"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15","publisher":"Mandiant / GTIG"}]}],"rotate":[{"item":"Every credential the appliance stored or injected","reason":"BeyondTrust and CISA: if you find exploitation evidence, treat stored and injected credentials as exposed. Rotate after the appliance is patched or rebuilt. Watch those accounts for logins outside a managed session and review new MFA registrations on privileged accounts.","sources":[{"url":"https://www.beyondtrust.com/blog/entry/bt26-05","date":"2026-10-16","publisher":"BeyondTrust"},{"url":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support","date":"2026-10-16","publisher":"CISA"}]},{"item":"/appliance administrators, /login users, API secrets, and vaulted endpoint credentials","reason":"Mandiant Option 3 order: /appliance administrative credentials; /login administrators and local users; API client secrets; security provider bind accounts and SAML signing keys; Remote Support Vault and integrated Password Safe or PRA credentials at the target system; integration credentials; any credential typed into a support session during the window.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15","publisher":"Mandiant / GTIG"}]}],"persistence":[{"kind":"path","value":"mangoapi.php under the site web root","detail":"Mandiant: SAWFLY web shell from one intrusion. Actor tooling rotates.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"kind":"path","value":"/usr/bin/dbus-authd","detail":"Mandiant: copied system shell with SUID root from one intrusion.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"kind":"path","value":"/home/bomgar/sbin/post_boot.d/zz-root-persist","detail":"Mandiant: startup script that grants passwordless root to the site service account.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"kind":"path","value":"/tmp/ingredi_ws and HAProxy path /uidchanarge","detail":"Mandiant: BARECLAW tunneler and reverse-proxy edit from one intrusion.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"}],"observedBehaviour":[{"title":"Web-shell staging then SAWFLY under the site web root","detail":"Mandiant: POST requests to /app_84304470%2Ephp, then mangoapi.php created about 11 minutes later. SAWFLY returns HTTP 404 unless a private parameter is present.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"title":"Jump Item and Team roles raised to Administrator","detail":"Mandiant recovered a user_changed syslog event that raised those roles from No Access to Administrator, then used support sessions and built-in file transfer against downstream endpoints.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"},{"title":"Local log deletion","detail":"Mandiant: the actor deleted host, web, and application logs during the intrusion. BeyondTrust: evidence kept only on the appliance may not survive.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","sourceDate":"2026-10-15"}],"evidence":[{"title":"Installed Remote Support version from before the patch","detail":"Preserve the /appliance version string so you can show whether the host was 26.2.3 or earlier while it was reachable.","sources":[{"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","date":"2026-10-15","publisher":"BeyondTrust"}]},{"title":"Off-box syslog, WAF, and firewall logs from 29 Aug 2026","detail":"Keep inbound path records, /login events, user_changed events, and SIEM receipt gaps. No published attacker IPs.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15","publisher":"Mandiant / GTIG"}]},{"title":"Forensic image or BeyondTrust Support export of /home","detail":"Mandiant found exploitation evidence in access, syslog, messages, thin-scc, brain, and SSL logs on the LUKS /home partition. BeyondTrust asks customers with evidence to open a Sev 1 case that cites BT26-05.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15","publisher":"Mandiant / GTIG"},{"url":"https://www.beyondtrust.com/blog/entry/bt26-05","date":"2026-10-16","publisher":"BeyondTrust"}]}],"limits":["Mandiant artefacts are from one intrusion. BeyondTrust says this actor rotates tooling.","No published network IOCs from a source we opened.","KB0024066 was not opened.","Customers cannot read LUKS /home logs without vendor support or a forensic image."],"sources":[{"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","date":"2026-10-15","publisher":"BeyondTrust"},{"url":"https://www.beyondtrust.com/blog/entry/bt26-05","date":"2026-10-16","publisher":"BeyondTrust"},{"url":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support","date":"2026-10-16","publisher":"CISA"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15","publisher":"Mandiant / GTIG"}],"updatedAt":"2026-10-31","addedDate":"2026-10-31"},"bulletins":[{"vendor":"BeyondTrust","title":"BT26-05 (CVE-2026-102764)","url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","date":"2026-10-15","cve":"CVE-2026-102764"}],"coverage":[{"title":"BT26-05","publisher":"BeyondTrust","url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","date":"2026-10-15","type":"vendor","addedDate":"2026-10-31"},{"title":"ARMORY CASTLE and BT26-05: What Security Teams Need to Know","publisher":"BeyondTrust","url":"https://www.beyondtrust.com/blog/entry/bt26-05","date":"2026-10-15","type":"vendor","addedDate":"2026-10-31"},{"title":"ARMORY CASTLE Exploits BeyondTrust","publisher":"Mandiant / Google Threat Intelligence Group","url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","date":"2026-10-15","type":"research","addedDate":"2026-10-31"},{"title":"NVD CVE-2026-102764","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102764","date":"2026-10-15","type":"government","addedDate":"2026-10-31"},{"title":"CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support","publisher":"CISA","url":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support","date":"2026-10-16","type":"government","addedDate":"2026-10-31"},{"title":"AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support","publisher":"Canadian Centre for Cyber Security","url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764","date":"2026-10-16","type":"government","addedDate":"2026-10-31"},{"title":"BeyondTrust Remote Support Zero-Day: Detecting and Investigating CVE-2026-102764","publisher":"Prophet Security","url":"https://www.prophetsecurity.ai/blog/beyondtrust-remote-support-zero-day","date":"2026-10-21","type":"news","addedDate":"2026-10-31"},{"title":"Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)","publisher":"Rapid7","url":"https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764/","date":"2026-10-30","type":"research","addedDate":"2026-10-31"}],"posts":[{"author_name":"Dark Web Intelligence","handle":"DailyDarkWeb","url":"https://x.com/DailyDarkWeb/status/2116488873878708290","date":"2026-10-31T11:14:04Z","text":"🚨 UPDATE: PUBLIC METASPLOIT EXPLOIT SUBMITTED FOR ALREADY-EXPLOITED BEYONDTRUST FLAW CVE-2026-102764\n\nRapid7 published an analysis on Oct 30, 2026 and opened a Metasploit pull request (Oct 30, 17:48 UTC) for CVE-2026-102764 in BeyondTrust Remote Support, showing unauthenticated code execution as the site's OS user on Remote Support 24.1.2. The pull request is still open, not yet merged."}],"research":[{"title":"BT26-05","url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","authors":"BeyondTrust","date":"15 Oct 2026"},{"title":"ARMORY CASTLE and BT26-05: What Security Teams Need to Know","url":"https://www.beyondtrust.com/blog/entry/bt26-05","authors":"BeyondTrust Security Team","date":"15 Oct 2026, last updated 16 Oct 2026"},{"title":"ARMORY CASTLE Exploits BeyondTrust","url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","authors":"Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram (Mandiant / GTIG)","date":"15 Oct 2026"},{"title":"NVD CVE-2026-102764 (Analyzed; Primary CVSS 3.1 9.8)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102764","authors":"NVD / BeyondTrust CNA","date":"published 15 Oct 2026, lastModified 17 Oct 2026, checked 31 Oct 2026"},{"title":"CISA KEV catalog JSON (CVE-2026-102764 listed; catalog 2026.10.30)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","authors":"CISA","date":"dateAdded 16 Oct 2026, catalog 2026.10.30, checked 31 Oct 2026"},{"title":"Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support","url":"https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764/","authors":"Jack Heysel, Rapid7","date":"30 Oct 2026"}],"impact":{"kind":"single-product","product":"BeyondTrust Remote Support","versions":[{"version":"Remote Support 24.3.1 through 26.2.3","status":"affected","versions":"BT26-05-RS","vendorStatement":{"date":"2026-10-15","url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","quote":"Affected: Remote Support All versions <= 26.2.3. Fixed: Remote Support BT26-05-RS patch for (v24.3.1 - v26.2.3)."},"addedDate":"2026-10-31"},{"version":"Remote Support older than 24.3.1","status":"affected","versions":"Upgrade, then BT26-05-RS","vendorStatement":{"date":"2026-10-15","url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","quote":"Affected: Remote Support All versions <= 26.2.3. Customers on a Remote Support version older than 24.3.1 will need to upgrade to a newer version to apply this patch."},"addedDate":"2026-10-31"},{"version":"BeyondTrust-hosted Remote Support (SaaS)","status":"vendor-managed-no-action","versions":"Patched by BeyondTrust as of 9 Oct 2026 (no customer action)","vendorStatement":{"date":"2026-10-15","url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","quote":"As of Oct 9, 2026, a patch that remediates this vulnerability has been applied to all Remote Support SaaS customers."},"addedDate":"2026-10-31"},{"version":"Privileged Remote Access (PRA)","status":"no-statement-yet","versions":"Patch released; BeyondTrust recommends self-hosted customers apply it","vendorStatement":{"date":"2026-10-16","url":"https://www.beyondtrust.com/blog/entry/bt26-05","quote":"While our internal testing has not identified any way for an attacker to exploit this vulnerability in Privileged Remote Access, PRA shares the affected code, so out of an abundance of caution, we have released the patch for PRA and recommend self-hosted Privileged Remote Access customers apply it immediately."},"addedDate":"2026-10-31"}]},"pocs":[{"title":"Rapid7 analysis: unauthenticated file upload to RCE (for defenders)","url":"https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764/","source":"Jack Heysel, Rapid7","validationStatus":"unverified","validationDate":null,"listedDate":"2026-10-30","notes":"Rapid7 reports file write leading to RCE as the site user on Remote Support 24.1.2 (30 Oct 2026). Independent validation: not verified. Listed for defenders. This site does not republish exploit code or usage steps.","addedDate":"2026-10-31"},{"title":"Metasploit PR 22083 (unmerged)","url":"https://github.com/rapid7/metasploit-framework/pull/22083","source":"Jack Heysel (jheysel-r7), Rapid7","validationStatus":"unverified","validationDate":null,"listedDate":"2026-10-30","notes":"Public, unmerged Metasploit PR; author reports RCE as site user on 24.1.2 (Rapid7, 30 Oct 2026). Opened 30 Oct 2026 17:48 UTC. Still open when checked 31 Oct 2026. Index link only. This site does not copy module code, payload steps, or usage instructions.","addedDate":"2026-10-31"}],"pocEmptyState":"Public Rapid7 analysis and an unmerged Metasploit PR are indexed. Independent validation: not verified.","_feed":{"page":"https://vuln2shell.com/vulns/beyondtrust-remote-support-cve-2026-102764","json":"https://vuln2shell.com/vulns/beyondtrust-remote-support-cve-2026-102764.json","iocsCsv":"https://vuln2shell.com/vulns/beyondtrust-remote-support-cve-2026-102764/iocs.csv","stix":"https://vuln2shell.com/vulns/beyondtrust-remote-support-cve-2026-102764/stix.json","badges":{"patch":"Patched","itw":"Exploited in the wild","poc":"Public PoC (unverified RCE)"}}}