CVE-2026-102764 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-10-15

Added to CISA KEV: 2026-10-16 1 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — ACTIVE EXPLOITATION: This vulnerability is being actively exploited in the wild by nation-state-linked actors. Treat as an active incident response scenario, not merely a patch management task.
IMMEDIATE — Self-hosted customers: Apply the patch released October 15, 2026 via the appliance administration interface immediately. SaaS customers were auto-patched by October 9, 2026 — verify your patch status in the admin console.
IMMEDIATE — Incident Response: Review appliance logs for indicators of compromise from before the patch date. Specifically look for: unauthorized file creation/modification events, presence of web shell files (particularly 'SAWFLY'), unexpected outbound connections, and access from anomalous IP addresses or geographies.
IMMEDIATE — Web shell hunt: Inspect the appliance filesystem for unauthorized files, particularly in web-accessible directories. SAWFLY web shell has been confirmed as the threat actor payload — engage BeyondTrust support for IOC specifics.
SHORT-TERM: If patching cannot be applied immediately, consider temporarily restricting network access to the appliance using firewall rules to known IP ranges (support staff source IPs) to reduce exposure while patching is arranged.
SHORT-TERM: Enable and review all available audit logging on the appliance. Forward logs to a SIEM if not already doing so. Look for anomalous internal message patterns consistent with origin spoofing.
SHORT-TERM: Rotate credentials and session tokens for accounts that authenticate through or to the BeyondTrust appliance, as a compromised appliance may have intercepted credentials from support sessions.
MEDIUM-TERM: Assess whether any endpoints that were remotely supported via this appliance between the estimated zero-day exploitation window and patching should be treated as potentially compromised.
MEDIUM-TERM: Implement network segmentation so that the BeyondTrust appliance has minimal lateral movement capability if re-compromised — restrict its outbound connectivity to only necessary destinations.
PATCH PRIORITY: CRITICAL — P0. Apply immediately. Active nation-state exploitation with web shell deployment confirmed. Do not wait for standard patch cycles.

🔍 Web Intelligence (Kagi · 2026-10-16)

Summary

CVE-2026-102764 is a critical vulnerability affecting BeyondTrust's Remote Support (formerly Bomgar) product, stemming from inadequate validation within its internal components. This flaw allows a remote, unauthenticated attacker to bypass security mechanisms and perform unauthorized file operations on the appliance. Because Remote Support is frequently used for privileged administrative access across enterprise networks, this vulnerability is significant as it provides a pathway for attackers to compromise sensitive infrastructure and establish persistent access.

Exploitation

Active Exploitation: The vulnerability has been actively exploited in the wild as a zero-day ^[2]^[4].
Threat Actors: The China-linked threat actor group known as "Armory Castle" (or PRC-Nexus) has been observed exploiting this vulnerability against self-hosted appliances to deploy the SAWFLY web shell ^[2].
Availability: While specific public exploit code may vary in accessibility, the active deployment of custom web shells by sophisticated actors confirms that functional exploit capabilities exist.
Prerequisites: Exploitation is remote and does not require authentication or user interaction, targeting the appliance's network-facing components ^[3].

Affected Products & Patches

Affected Products: BeyondTrust Remote Support (formerly Bomgar) appliances.
Patch Availability: A patch was officially disclosed and released by BeyondTrust on October 15, 2026, under advisory BT26-05 ^[1]^[5].
Mitigations:

* SaaS Customers: The patch was automatically applied to all Remote Support SaaS customers by October 9, 2026 ^[1]. * Self-Hosted Customers: Administrators should manually apply the patch via the appliance's administration interface if automatic updates are not enabled or configured ^[1].

Impact

Access/Capability: Successful exploitation grants the attacker the ability to perform arbitrary file operations, which can lead to further system compromise, such as the deployment of web shells (e.g., SAWFLY) for remote command execution ^[1]^[2].
Business Risk: For internet-facing deployments, this risk is extreme. Because the product is designed for remote support, gaining unauthorized control of the appliance can provide attackers with a foothold into the internal network, potentially allowing them to pivot, intercept credentials, or control managed end-user systems, leading to large-scale data breaches or infrastructure disruption.

Sources

BT26-05 | BeyondTrust
As of Oct 9, 2026, a patch that remediates this vulnerability has been applied to all Remote Support SaaS customers. Self-hosted customers of Remote Support should manually apply the patch if their instance is not subscribed to automatic updates in their / appliance interface. ... BeyondTrust has re…
China-Linked Hackers Exploited BeyondTrust Zero-Day to ...
Armory Castle exploited a BeyondTrust Remote Support zero-day on a self-hosted appliance and deployed the SAWFLY web shell.
CVE-2026-102764: Authentication Bypass by Spoofing | CVETodo
CVE-2026-102764 is a CVSS 9.3 Authentication Bypass by Spoofing vulnerability in Remote Support. See exploitation status, patch guidance, and technical details.
BEYONDTRUST REMOTE SUPPORT CVE-2026-102764 ...
CRITICAL: BEYONDTRUST REMOTE SUPPORT CVE-2026-102764 EXPLOITED AS ZERO-DAY BY PRC-NEXUS ARMORY CASTLE BeyondTrust disclosed BT26-05 ...
Gianluca Varisco's Post
On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances.

🔴 CVE-2026-102764