lee1981 (@lee1981b) on X

What it is

CVE-2026-102764 is a CWE-290 origin-validation flaw in internal BeyondTrust Remote Support (RS) messaging, advisory BT26-05, CNA CVSS v4.0 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Under suitable conditions it allows file operations on the appliance. The exact trigger is withheld by the vendor. This CyberForge post is a defender's investigation guide built on the BeyondTrust and Mandiant/GTIG disclosures of 15 October.

Preconditions / Affected

• RS through 26.2.3 without verified application of patch BT26-05-RS. The patch supports 24.3.1–26.2.3.
• Releases older than 24.3.1 need a supported upgrade first, then the patch. The page says not to invent a "fixed" successor build.
• The CNA's affected range (ends at 26.2.3) does not encode the separate patch, so keep the named-patch qualification alongside it.
• Auto-update enrolment or a base-version screenshot does not prove the patch was installed. Keep the actual installation result.
• RS SaaS: BeyondTrust says it was patched by 9 October. Historical credential and configuration review may still apply.
• Privileged Remote Access (PRA) shares the affected code. BeyondTrust found no exploitable path and recommends a precautionary patch. No PRA build matrix was given.

How it works

Mandiant's observed intrusion chain, which is not guaranteed to be a direct effect of the CVE:

1. File upload.
2. SAWFLY web shell running as an unprivileged site service account.
3. Later root escalation.
4. Persistence and tunnelling, reported to survive reboot and configuration reset, with log tampering.

Exploitation was reported from 29 August (one hosted instance, one self-hosted appliance). The vendor found the hosted event on 28 September. Fix validation followed by 30 September, shipment on 8 October and SaaS completion on 9 October.

What to do

1. Get the site identity, build and BT26-05-RS installation receipt from the owner. Missing evidence stays unresolved.
2. Preserve evidence in parallel with the patch, without indefinitely delaying it: - off-device syslog, proxy/WAF, firewall, identity and session records; - protected host evidence via BeyondTrust/IR; - where feasible, a VM snapshot including memory and disk.
3. Hunt on authorised acquired copies, not live. Hashes and YARA rules (G_Hunting_Webshell_SAWFLY_1, G_Hunting_Backdoor_BARECLAW_1) come from GTIG: - SAWFLY mangoapi.php: dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb - BARECLAW ingredi_ws: 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462 - Staging lead app_84304470%2Ephp was not recovered, so no hash exists. - Other leads: WebSocket URI /uidchanarge, /usr/bin/dbus-authd, /home/bomgar/sbin/post_boot.d/zz-root-persist, and sudoers and HAProxy templates.
4. Correlate in the logs: user_changed events and Jump Item/Team permissions raised from No Access to Administrator, followed by support sessions. Example fields are who, who_ip, target and status; verify them against your release's schema. Review the original alert dispositions, because third-party triage closed real escalation alerts as false positives.
5. If compromise is suspected, open a Sev 1 case with BeyondTrust citing BT26-05. Mandiant recommends clean, patched redeployment for confirmed or unresolved compromise, ideally from a pre-exposure backup.
6. After patching or rebuilding, rotate admin, API and integration credentials, stored secrets, and certificates (coordinated with support). Then recheck permissions, session policy and logging destinations.

flowchart TD
  A[RS appliance] --> B{BT26-05-RS receipt?}
  B -- No/unknown --> C[Treat as exposed: patch + preserve]
  B -- Yes --> D{Evidence of earlier access?}
  C --> D
  D -- Hits or unresolved gaps --> E[Sev 1, IR, clean redeploy, rotate creds]
  D -- Clean with full logs --> F[Verify monitoring, close]

Caveats

• No verified actor IPs or domains exist, since infrastructure rotates. A negative IOC search cannot clear an appliance.
• The hashes and rules describe post-exploitation tooling. They do not prove entry via this CVE, and rule matches need triage.
• KEV has no entry, but the snapshot predates CNA publication. EPSS returned no row, which is not a zero score.
• The authenticated KB patch procedure was unreadable to the author, so get the install steps from BeyondTrust. The exact trigger and the full escalation mechanism remain unestablished.