CVE-2026-102764

Name of the Vulnerable Software and Affected Versions BeyondTrust Remote Support versions prior to 26.2.3

Description Internal components of the software fail to adequately validate the origin of received messages, leading to an unauthenticated file upload flaw. This allows an attacker to perform arbitrary file operations on the appliance, potentially resulting in full host compromise and root-level access. In real-world incidents, the actor ARMORY CASTLE exploited this as a zero-day to deploy the SAWFLY webshell via a POST request to /app 84304470%2Ephp and the BARECLAW SOCKS5-over-WebSocket tunneler using the path /uidchanarge. The attackers escalated privileges by creating a SUID root shell and extracted sensitive data from the appliance vault using the bt-secrets CLI binary. Additionally, the actor modified haproxy.conf to route traffic to a backend webskd3 on port 19800 to maintain a stealthy backdoor.

Recommendations Apply patch BT26-05 for versions up to 26.2.3. For versions older than 24.3.1, upgrade the software before applying patch BT26-05-RS. Rotate all vault, API, and administrator credentials after patching or rebuilding the appliance. As a temporary mitigation, restrict internet access to the appliance and monitor haproxy.conf for unknown ACL entries or non-standard backend routes.