BeyondTrust patches zero-day exploited since August

BeyondTrust has patched a critical authentication bypass in its Remote Support (RS) product after attackers exploited it since late August. The company said the activity involved a suspected China-linked espionage actor.

Tracked as CVE-2026-102764, the flaw allowed unauthenticated remote attackers to perform file operations on vulnerable appliances. It affected RS 26.2.3 and earlier. BeyondTrust patched Remote Support and Privileged Remote Access SaaS customers on October 8. Self-hosted customers must apply the patch manually if automatic updates are disabled.

Mandiant and Google Threat Intelligence Group track the suspected actor as Armory Castle, formerly UNC5221; CrowdStrike calls it Warp Panda. Mandiant said attackers used the flaw to gain access, escalated to root privileges by enabling Set User ID (SUID) permissions, and deployed Sawfly web shell and Bareclaw tunneler malware. They also wiped logs and used compromised Administrator credentials to move through victim networks.

Shadowserver tracks more than 1,400 BeyondTrust Remote Support instances exposed online, but does not say how many are patched or honeypots. BeyondTrust said it serves more than 20,000 customers worldwide, including government agencies and 75% of Fortune 100 companies.