Counting the Boxes: A 2,185-Asset Inventory of BeyondTrust Remote Support Edge Appliances

Edge appliances are reachable from the internet by design. When a zero-day lands on one of them, the question stops being theoretical and becomes an inventory question. CVE-2026-102764 is a case in point.

What the public record establishes

BeyondTrust published advisory BT26-05 for its Remote Support product, and the National Vulnerability Database describes the flaw as inadequate validation of the origin of messages handled by internal components, allowing an attacker to perform file operations on the appliance. NVD maps it to CWE-290, authentication bypass by spoofing, and scores it CVSS 4.0 9.3 and CVSS 3.1 9.8, both with network attack vector, no privileges required and no user interaction.

CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities catalog on 2026-10-16 with a remediation due date of 2026-10-19, marking forensic triage as required under BOD 26-04 and ransomware association as unknown. The vendor states a patch is available and several mitigations exist.

Reporting by The Record describes exploitation in an espionage campaign attributed by Mandiant and Google Threat Intelligence Group to a group tracked as Armory Castle or UNC5221, active since October 2023 and previously associated with zero-day exploitation of Ivanti and Citrix edge products. Mandiant observed privilege escalation, lateral movement and a deeper foothold in the victim network, alongside custom tooling named Sawfly and Bareclaw. The same reporting states the actor obtained every credential the appliance stored and modified files that survive reboots and configuration resets.

That last detail changes the defensive posture. An appliance that stored credentials and retained attacker changes across reboots cannot be cleared by a restart, and it cannot be cleared by a patch alone.

Why an exposure count is the right starting point

Most organisations cannot answer a simple question: how many appliances that terminate remote support sessions do we actually operate, and which of those answer on the public internet? These devices are usually bought by IT operations rather than by the security team, and they are often justified as internal tooling while being deployed with an internet-facing listener.

External measurement gives a first-order answer for the population, not for one organisation. A ZoomEye search on the product fingerprint returns a global count of matching assets. Against app="Bomgar", the long-standing product name for Remote Support, ZoomEye reported 2,185 matching assets on 2026-10-26.

Two cautions apply to that number. First, it counts assets that match a product fingerprint, not assets confirmed vulnerable to CVE-2026-102764, and not assets confirmed compromised. Version information is frequently absent from a banner. Second, the auxiliary probes show how easily a query drifts. title="Remote Support" returns 863,696 matches, which is a measure of generic web page titles rather than of this product, and it is useless for prioritisation. The narrower fingerprint is the defensible one even though it is smaller.

From a global count to a work list

The global figure is context. The useful output is a per-organisation list built the same way, constrained by the network ranges, certificate subjects and hostnames that the organisation actually owns, and compared against its own asset register. Three practical steps follow.

1. Enumerate externally. Query the product fingerprint restricted to owned address space, certificate subject names and hostname patterns, and record the collection time with each result.
2. Reconcile against the internal register. Every externally visible appliance should map to a named owner and a change record. Appliances that appear in measurement but not in the register are the ones nobody is patching.
3. Classify by treatment state. Separate appliances that are patched, appliances that have an approved mitigation applied, and appliances whose state is simply unknown. The third group is where incidents hide.

What the measurement cannot tell you

An exposure count says a device answered a scan. It does not say the device is unpatched, does not say an attacker touched it, and does not say credentials were taken. Mandiant's guidance points the other way from blind confidence: any vulnerable appliance reachable from the internet should be treated as potentially compromised until it has been reviewed, which is a statement about investigation, not about counting.

With CVE-2026-102764 the gap between "reachable" and "possibly compromised" is unusually narrow. The vulnerability requires no privileges and no user interaction, exploitation has been observed since before public disclosure, and the actor reportedly modified files that survive configuration resets. Google Threat Intelligence Group has warned that the actor typically moves to broad opportunistic exploitation after a flaw becomes public, which is exactly the interval many organisations are in now.

Closing the loop

An inventory is only worth the action attached to it. For each externally visible Remote Support appliance the sequence is short: patch or apply the vendor mitigation, verify the patch actually took effect on the appliance rather than on a staging copy, rotate every credential the device could have held, and compare the device against a known-good build to catch changes that would survive a reset. Where the appliance cannot be cleaned to a trusted state, replacement is the only defensible option.

2,185 assets matching one fingerprint is a reminder of how much remote-support infrastructure is publicly addressable, and how little of it any single organisation can see.

References

• The Record, "Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day": https://therecord.media/beyond-trust-cyberattack-china
• NVD, CVE-2026-102764: https://nvd.nist.gov/vuln/detail/CVE-2026-102764
• CISA Known Exploited Vulnerabilities catalog, CVE-2026-102764: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764
• BeyondTrust advisory BT26-05: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
• ZoomEye search used for the published count: https://www.zoomeye.ai/searchResult?q=YXBwPSJCb21nYXIi