BeyondTrust Remote Support Authentication Bypass Added to CISA KEV After Confirmed Espionage Intrusions
Our advisory VTA-2026-000079, published on 2026-02-09, covered the exploitation of BeyondTrust remote access products and the KEV-listed flaw CVE-2026-1731. This update exists because a separate and newly disclosed vulnerability now affects the same product line. On 15 October 2026 BeyondTrust disclosed CVE-2026-102764, a critical authentication bypass in Remote Support carrying a CVSSv4 score of 9.3, which allows an unauthenticated remote attacker to perform file operations on an affected appliance with no user interaction. Remote Support versions 26.2.3 and earlier are affected unless the BT26-05-RS patch has been applied, and the vendor states that all Remote Support SaaS customers were patched as of 9 October 2026. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 16 October 2026 with a 19 October 2026 due date and forensic triage marked as required, and fresh post-exploitation indicators have since been published from the incident investigations.
The flaw is classified as authentication bypass by spoofing (CWE-290): internal Remote Support components do not adequately validate the origin of incoming messages, which permits file operations on the appliance without valid credentials. BeyondTrust is withholding further exploitation detail while customers apply the patch, so the precise request sequence used by the attackers is not public. What has been described publicly is the post-exploitation activity observed on a compromised self-hosted appliance: arbitrary file uploads, deployment of the SAWFLY PHP web shell and the BARECLAW tunneler, escalation to root, attempted extraction of the credential vault, the establishment of persistence, and deletion of logs to frustrate later investigation. Two Remote Support compromises are currently known, both dated 29 August 2026 — one BeyondTrust-hosted instance and one self-hosted appliance. The hosted compromise was discovered and contained on 28 September 2026, and corroborating findings from the self-hosted investigation were shared on 30 September 2026. The activity is attributed to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221; that attribution is assessed rather than confirmed.
Remote Support appliances sit in an unusually sensitive position, holding privileged reach into managed endpoints and storing or brokering credentials for them, which makes a pre-authentication file-write primitive on such a device a direct route to onward access across an estate. The confirmed activity reinforces that: the attacker moved from file upload to web shell, to root, to an attempt against the credential vault, and then to log deletion, meaning any organisation that was exposed cannot assume patching alone closes the matter. Exploitation status is not in doubt — CVE-2026-102764 is listed in the CISA KEV catalogue as of 16 October 2026, which confirms in-the-wild use, while FIRST EPSS currently puts the probability of exploitation in the next 30 days at 1.2 percent. That comparatively low EPSS figure reflects the narrow, espionage-driven targeting observed so far rather than any reduction in risk to an exposed appliance, and the KEV due date of 19 October 2026 with mandatory forensic triage signals how the issue is being treated at federal level. This is also the second BeyondTrust remote access vulnerability to reach KEV this year, after CVE-2026-1731 was listed on 13 February 2026; that earlier flaw has known use in ransomware campaigns and carries an EPSS probability of 92.5 percent, so organisations that run these appliances are facing sustained interest in the product line rather than a single isolated event. Customers operating self-hosted Remote Support appliances, particularly any internet-reachable instance running 26.2.3 or earlier without the BT26-05-RS patch, are the affected population.
Attack Surface
Remote Access Service, System Management Service, Cloud Service
Tactics
Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Command and Control
Techniques
- T1190 – Exploit Public-Facing Application
- T1505.003 – Server Software Component: Web Shell
- T1068 – Exploitation for Privilege Escalation
- T1555 – Credentials from Password Stores
- T1572 – Protocol Tunneling
- T1070 – Indicator Removal
SuperPRO's Threat Countermeasures Procedures
- Apply the BT26-05-RS patch to every self-hosted BeyondTrust Remote Support appliance running 24.3.1 through 26.2.3, and confirm the patch is installed through the appliance's /appliance interface — the patch must be applied manually where automatic updates are not enabled.
- For Remote Support deployments older than 24.3.1, upgrade first to a patch-supported release in the 24.3.1 to 26.2.3 range and then apply BT26-05-RS; the patch cannot be installed on pre-24.3.1 builds.
- Validate SaaS tenant status against the vendor statement that all Remote Support SaaS instances were patched as of 9 October 2026, and record the tenant build number as evidence for the CISA KEV due date of 19 October 2026.
- Perform the forensic triage CISA marks as required for CVE-2026-102764: hunt for unauthorised PHP files written into web-accessible appliance directories consistent with the SAWFLY web shell, and for BARECLAW tunneler binaries or long-lived outbound tunnels from the appliance to unfamiliar destinations.
- Review appliance and session logs for gaps, truncation or wholesale deletion from 29 August 2026 onward — log deletion was part of the observed intrusion chain, so an unexplained absence of entries is itself a triage trigger rather than a clean result.
- Rotate every secret the Remote Support appliance stores or can reach, including vault entries, appliance administrator passwords, Jump Client and API credentials, LDAP or Active Directory bind accounts and TLS certificates, given the documented attempt at credential-vault extraction.
- Restrict network reachability of the Remote Support appliance and its /appliance administrative interface to approved administrative ranges, VPN or jump hosts, and alert on unauthenticated HTTP requests that result in file writes to the appliance filesystem.
