Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October 2026, CISA issued an urgent advisory disclosing active exploitation of CVE-2026-102764, a critical authentication bypass vulnerability in BeyondTrust Remote Support (formerly Bomgar) versions 24.3.1 and earlier. Threat actors tracked under the campaign identifier ARMORY CASTLE are leveraging this flaw to gain unauthenticated initial access to self-hosted Remote Support appliances, then establishing persistence, escalating privileges, and moving laterally across enterprise networks. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 16, 2026, and patch BT26-05-RS is available for supported versions. SaaS-hosted deployments were patched automatically, but on-premises environments remain at significant risk without immediate action.

This incident underscores a persistent and accelerating pattern of threat actors targeting privileged remote-access and support infrastructure as a high-value initial access vector. As remote-access tooling becomes increasingly embedded in enterprise and government IT operations, unpatched appliances represent a critical exposure surface that adversaries are systematically scanning and exploiting within days of disclosure.

Why This Matters Now

CVE-2026-102764 was added to CISA's KEV catalog the same day as the advisory, confirming active in-the-wild exploitation with no waiting period. Organizations running self-hosted BeyondTrust Remote Support appliances face immediate risk of full network compromise; the attack chain progresses from unauthenticated access to lateral movement rapidly, making delayed patching equivalent to leaving a privileged backdoor open to threat actors.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

CVE-2026-102764 is a critical authentication bypass vulnerability in BeyondTrust Remote Support versions 24.3.1 and earlier that allows unauthenticated threat actors to gain initial access to self-hosted appliances. CISA rated it critical because active exploitation by the ARMORY CASTLE campaign has already been confirmed, enabling a full attack chain from initial access through privilege escalation and lateral movement.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker's ability to exploit a publicly reachable BeyondTrust appliance, pivot laterally across internal networks, and exfiltrate data outbound all depend on unrestricted network reachability that CNSF controls are designed to constrain. By enforcing segmentation, identity-aware access boundaries, and controlled egress, CNSF would likely have reduced the appliance's exposed attack surface and limited the blast radius of a successful compromise.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: The reachability of the unpatched BeyondTrust administrative interface from untrusted external sources would likely be constrained, reducing the pool of actors capable of delivering the exploit payload against the appliance.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: The scope of privilege an attacker could exercise after gaining a foothold on the appliance would likely be constrained by identity-aware policies that limit which identities are permitted to invoke privileged session creation or assume administrative roles within defined trust boundaries.

Lateral Movement

Control: East-West Traffic Security

Mitigation: The appliance's ability to initiate connections to internal workloads outside its defined operational scope would likely be reduced, constraining lateral reachability even when the attacker holds valid credentials recovered from the compromised appliance.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Unexpected outbound session patterns and anomalous automation activity originating from the appliance would likely be surfaced through centralized traffic observability, reducing the window during which covert C2 channels could operate undetected.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Outbound data transfers to destinations outside the appliance's authorized egress profile would likely be constrained, reducing the volume of sensitive material that could be moved to attacker-controlled infrastructure without triggering an enforcement response.

Impact (Mitigations)

Had segmentation and egress controls been in place across earlier stages, the attacker's reach within the internal environment would likely have been narrower, reducing the number of managed endpoints exposed to session hijacking and limiting the credential material accessible for downstream compromise.

Impact at a Glance

Affected Business Functions

  • Privileged Remote Access and IT Support Operations
  • Identity and Access Management (IAM) / Credential Vaulting
  • Security Operations Center (SOC) Visibility and Incident Response
  • Enterprise IT Help Desk and Remote Session Management
Operational Disruption

Estimated downtime: 14 days

Financial Impact

Estimated loss: N/A

Data Exposure

Organizations running self-hosted BeyondTrust Remote Support appliances face exposure of all credentials stored or injected by the appliance, including privileged account passwords, service account tokens, and session keys. Threat actors exploiting this vulnerability have demonstrated capability to establish persistence, escalate privileges, and move laterally across enterprise networks. Data at risk includes administrative credentials for downstream systems, session recordings containing sensitive operational data, privileged access policy configurations, and potentially regulated data accessible through compromised privileged sessions. The attack surface spans any system accessible via BeyondTrust-managed privileged sessions, making the blast radius highly dependent on the scope of the appliance deployment. Financial loss estimate is set to zero as no confirmed monetary damages have been publicly disclosed for this specific advisory context; however, costs associated with forensic investigation, credential rotation, system rebuilding, and potential regulatory notification are expected to be substantial for affected organizations.

Recommended Actions

  • • Apply the BT26-05-RS patch immediately and restrict external access to BeyondTrust Remote Support administrative interfaces to trusted networks only, leveraging Cloud Firewall (ACF) FQDN and IP-based ingress controls to enforce network-level access restrictions and reduce the exposed attack surface for CVE-2026-102764.
  • • Deploy Inline IPS (Suricata) with up-to-date CVE-specific signatures at the network perimeter and inline with Remote Support appliance traffic to detect and block exploit payload delivery attempts targeting authentication bypass vulnerabilities before they achieve initial access.
  • • Enforce Zero Trust Segmentation with least-privilege, identity-based microsegmentation policies around the Remote Support appliance to prevent lateral movement — ensuring the appliance can only initiate connections to explicitly authorized internal endpoints and cannot serve as a pivot point for broader network traversal.
  • • Enable Multicloud Visibility & Control and Egress Security & Policy Enforcement with FQDN filtering and outbound traffic baselining to detect anomalous C2 communications and unauthorized data exfiltration from the appliance, generating alerts on any outbound sessions to destinations outside an approved allowlist.
  • • Immediately rotate all credentials stored or injected by the appliance, revoke all active support sessions, and forward appliance syslog and session events to a SIEM, then conduct network and memory forensics using CISA and Mandiant ARMORY CASTLE guidance to hunt for indicators of compromise including unrecognized privileged sessions, unauthorized permission changes, and unexpected log gaps.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image