BeyondTrust Patches Critical Zero-Day in Remote Support Exploited Since August
BeyondTrust issued urgent patching guidance for a critical authentication bypass in its Remote Support software that threat actors have exploited since late August.
Key points
- The flaw, CVE-2026-102764, affects Remote Support versions 26.2.3 and earlier and allows unauthenticated attackers to perform file operations.
- Mandiant and Google Threat Intelligence Group attribute the attacks to the Armory Castle espionage group, also known as Warp Panda.
- SaaS customers were patched on October 8, but self-hosted installations require manual updates if automatic patching is disabled.
BeyondTrust warned customers on Thursday to immediately apply a patch for a critical zero-day vulnerability in its Remote Support (RS) product. The flaw has been actively exploited in the wild since late August, allowing threat actors to bypass authentication and compromise enterprise systems.
Tracked as CVE-2026-102764, this authentication bypass vulnerability permits unprivileged remote attackers to execute file operations on unpatched appliances. The issue affects Remote Support version 26.2.3 and any earlier releases. BeyondTrust confirmed that the vulnerability was leveraged by a suspected China-nexus espionage actor in sustained attacks.
Threat Actor Tactics and Impact
Security researchers from Mandiant and Google Threat Intelligence Group (GTIG) track the responsible group as Armory Castle, formerly known as UNC5221. CrowdStrike cybersecurity firm identifies the same actor under the alias Warp Panda. These groups used the zero-day flaw to gain initial access to targeted networks during the exploitation window.
According to Mandiant, the attackers escalated privileges to root by enabling Set User ID (SUID) permissions on compromised devices. They subsequently deployed new Sawfly web shell and Bareclaw tunneler malware. The group wiped system logs to evade detection and moved laterally through victim networks using stolen Administrator credentials.
"After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host," Mandiant stated. This access granted attackers control over every credential stored or brokered by the appliance, as well as the ability to modify persistent files that survive reboots.
Scope and Exposure
BeyondTrust patched the security issue for all Remote Support and Privileged Remote Access SaaS customers on October 8. However, organizations running self-hosted installations must manually apply the patch if automatic updates are not enabled. Failure to update leaves systems vulnerable to active exploitation.
Internet threat monitoring service Shadowserver tracks more than 1,400 BeyondTrust remote support instances exposed online. The watchdog provides no data on how many of these instances have been secured or are honeypots. Mandiant advises that any internet-reachable appliance on a vulnerable version should be treated as potentially compromised until reviewed.
What should you do?
Organizations should verify their Remote Support version immediately. If running 26.2.3 or earlier, apply the latest patch from BeyondTrust without delay. Self-hosted users must ensure automatic updates are enabled or perform manual patching. Monitor logs for signs of Sawfly web shell or Bareclaw tunneler activity.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: BeyondTrust
- Verify your current Remote Support version and apply the patch for CVE-2026-102764 immediately if you are running 26.2.3 or earlier.
- Ensure automatic updates are enabled on all self-hosted installations to prevent future exposure to unpatched vulnerabilities.
- Review system logs for evidence of Sawfly web shell or Bareclaw tunneler deployment, especially on internet-facing appliances.
- Assume any internet-reachable vulnerable appliance is compromised and conduct a thorough forensic review before trusting stored credentials.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of BeyondTrust Remote Support are affected by this zero-day?
Remote Support version 26.2.3 and all earlier versions are affected by the authentication bypass vulnerability tracked as CVE-2026-102764.
How did the threat actors escalate their access after exploiting the flaw?
Attackers enabled Set User ID (SUID) permissions to escalate to root privileges, then deployed malware and used stolen credentials to move laterally.
Are SaaS customers already patched?
Yes, BeyondTrust patched all Remote Support and Privileged Remote Access SaaS customers on October 8, but self-hosted users must patch manually.
