# BeyondTrust Remote Support: when an internal message could trigger file operations

> CVE-2026-102764 allowed operations on BeyondTrust appliance files. Mandiant traces its exploitation, persistence and traces to look for.

Published: 2026-11-05  
Canonical: https://rootzero.eu/en/research/beyondtrust-remote-support-message-file-operations-2026/

**Notice of October 15, 2026; zero-day exploitation observed at the end of August.** [BeyondTrust](https://www.beyondtrust.com/trust-center/security-advisories/bt26-05) describes CVE-2026-102764 as insufficient validation of the origin of messages received by an internal Remote Support component. Under certain conditions, a remote actor could trigger operations on the appliance's files. [Mandiant](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust) found, in an incident response, exploitation prior to disclosure, followed by privilege escalation and the installation of persistence tools.

## Why an internal message is a security boundary

A remote support appliance necessarily receives external requests, but its internal services can modify files that the public interface cannot reach. The server must therefore validate both *what* a message requests and *who* is authorized to send it. The problem reported by BeyondTrust lies in this proof of origin: the component was not performing sufficient validation before processing certain messages. The documented primitive is the file operation; the advisory does not publish the message format or a detailed PoC that would let us reliably reconstruct the triggering request.

The distinction protects the analysis from easy extrapolation. A file write can become a webshell if it targets a path executed by the server, but this transition requires an accessible destination and appropriate permissions. Mandiant reports **an observed attack chain**, not an automatic property of any file operation. Its report describes creating the **SAWFLY** webshell in a web path and then using **BARECLAW** to establish a tunnel. It also documents the use of appliance-specific utilities, boot templates, and internal proxy routes to escalate privileges and maintain access.

## What the traces of the incident show

Mandiant identified the first exploit in the access logs and system logs of a LUKS-protected `/home` partition. The actor it calls **ARMORY CASTLE** exploited the flaw as a zero-day in August 2026. The team observed deletions of logs and artifacts; a search based solely on a file indicator present at the time of analysis would therefore have been insufficient. The report constitutes a direct observation of compromise, while attributing the actor to a larger picture is up to Mandiant's assessment.

To find this class of problem in an authorized audit, one must follow each transition between public input and internal message bus, identify the identity or provenance fields, then verify that they are produced by a trusted component and not simply taken from a remote request. A security test compares the same transaction when it comes from an authorized internal service and when it is submitted by an unauthorized client. It is then necessary to measure the scope of the file operations obtained, without assuming RCE until an execution path is demonstrated.

## Versions and response

BeyondTrust says SaaS customers received a patch on **October 9, 2026**; Self-hosted deployments should apply patch **BT26-05-RS** on affected versions or upgrade to **26.3.1** and later. The bulletin lists versions up to **26.2.3** as affected. Organizations should distinguish patching the product from investigating a prior intrusion: SAWFLY, BARECLAW, configuration changes, and tampered logs require separate review.

The lesson goes beyond Remote Support: a message that circulates between components of an appliance is not reliable by its “internal” position alone. It is necessary to establish its provenance at the trust boundary, then limit the effect that a component can have on the file system.

**Primary sources:** [BeyondTrust advisory BT26-05](https://www.beyondtrust.com/trust-center/security-advisories/bt26-05), [Mandiant investigation](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust).