If your organization runs a self-hosted BeyondTrust Remote Support appliance (formerly Bomgar), treat it as compromised until you prove otherwise. A China-nexus espionage group has been exploiting a critical zero-day in the platform since late August, and CISA just added the flaw to its Known Exploited Vulnerabilities catalog. Organizations are running out of time to patch before the window closes.

The vulnerability: CVE-2026-102764 (CVSS 9.3)

Tracked as CVE-2026-102764 with a CVSS 4.0 score of 9.3, the flaw is an improper origin validation issue (CWE-290) in an internal messaging component of BeyondTrust Remote Support. The components “did not adequately validate the origin of the messages it received,” and under the right conditions a remote attacker with no authentication can use it to perform file operations on the appliance. From file operations to full appliance compromise is a short hop — Mandiant and Google Threat Intelligence Group observed host-level takeover, credential theft, and lateral movement in real intrusions.

The threat actor: ARMORY CASTLE

Google-owned Mandiant and GTIG attribute the attacks to ARMORY CASTLE, a suspected China-linked espionage group previously tracked as UNC5221 and Warp Panda. The group has a long history of weaponizing zero-days in edge and remote-access appliances, including Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282). BeyondTrust says first exploitation of this flaw occurred on August 29, 2026 against a self-hosted appliance, and a second victim became public on September 27, triggering the vendor’s investigation. The group’s MO is surgical: selective zero-day use against high-value targets, then broad exploitation of every unpatched instance once a vulnerability goes public.

What the attackers did after breaking in

This is not a quick smash-and-grab. Mandiant documented a full post-exploitation toolkit:

• SAWFLY webshell: a lightweight PHP web shell (mangoapi.php) providing interactive remote access and encrypted bidirectional command-and-control, returning HTTP 404 to anyone who doesn’t send the right obfuscated parameter.
• Root persistence: the actors copied the system shell to /usr/bin/dbus-authd with SUID permissions, giving them root execution on demand, and planted a startup script in /home/bomgar/sbin/post_boot.d that grants the site service account passwordless sudo via the sudoers template.
• Credential vault theft: they used the appliance’s own bt-secrets CLI to dump stored passwords, API keys, and endpoint credentials, then deleted the audit logs to cover their tracks.
• BARECLAW tunneler: a custom C-based SOCKS5 proxy tunneler (ingredi_ws) that encapsulates TCP over WebSockets, giving the attackers a covert relay into the internal network — they even edited haproxy.conf so it was reachable from the internet.
• Legitimate feature abuse: using compromised admin accounts, they escalated Jump Item and team permissions to Administrator and launched legitimate Remote Support sessions to internal endpoints, using the built-in file transfer service to exfiltrate documents and software inventories straight from user desktops.
• Log wiping: systematic deletion of system, web server, and application logs throughout the intrusion.

Who is affected and how to fix it

All Remote Support versions up to and including 26.2.3 are vulnerable. BeyondTrust patched all SaaS tenants automatically on October 9, 2026 — no action needed there. Self-hosted customers running 24.3.1 through 26.2.3 must manually apply patch BT26-05-RS from advisory BT26-05. If you’re on a version older than 24.3.1, you must upgrade to a supported version first, then apply the patch. CISA added CVE-2026-102764 to the KEV catalog on October 16, 2026, giving federal agencies an October 19, 2026 remediation deadline — and giving every other organization a very strong hint about where to put this on the priority list.

Action items right now

• Patch immediately. Apply BT26-05-RS to every self-hosted Remote Support appliance, or upgrade and then patch if you’re on an older branch.
• Limit external exposure. Restrict access to the appliance to only the services and source IPs that actually need it. Remote support appliances should never sit fully exposed on the internet.
• Hunt for indicators. Check for a /usr/bin/dbus-authd file, unexpected scripts in /home/bomgar/sbin/post_boot.d, edits to sudoers.template or haproxy.conf, missing bt-secrets logs, and unrecognized privileged or administrative sessions in the appliance portal.
• Treat exposed appliances as compromised. If your appliance was internet-reachable on a vulnerable version between late August and patching, Mandiant’s guidance is blunt: review it (including memory forensics) until you’ve proven it’s clean, and if in doubt, isolate and rebuild from a known-good state.
• Rotate credentials. After remediation, rotate any credentials stored in or brokered by the appliance — Remote Support exists to hold exactly the kind of secrets that make lateral movement trivial.

Remote support platforms sit at the trust boundary between external technicians and your internal network, which is precisely why state-sponsored groups keep targeting them. The patch exists, the exploitation is confirmed, and the clock is ticking. Patch today — or assume the help desk tool is helping someone else.