BeyondTrust patches zero-day exploited in attacks since August

BeyondTrust has issued a warning to its customers regarding a critical vulnerability in its Remote Support (RS) product, which has been the target of zero-day attacks since late August.

Remote Support serves as an enterprise-grade solution designed to assist IT service desks, help desks, and customer support teams in resolving issues remotely.

The vulnerability, identified as CVE-2026-102764, is characterized as an authentication bypass that allows unprivileged remote attackers to carry out file operations on unpatched appliances. This issue impacts RS version 26.2.3 and earlier. BeyondTrust expedited the resolution for its Remote Support and Privileged Remote Access SaaS customers on October 8, while customers with self-hosted installations will need to apply the patch manually if automatic updates are not activated.

While specific details about the vulnerability have been limited, BeyondTrust disclosed that it has been actively exploited by a suspected espionage group connected to China, referred to as "Armory Castle" (previously known as UNC5221), as per observations from Mandiant and Google Threat Intelligence Group (GTIG) security researchers. The group has also been identified by cybersecurity firm CrowdStrike under the name "Warp Panda."

Mandiant researchers were the first to detect the initial wave of attacks. The actors behind Armory Castle exploited this vulnerability to gain initial access to devices and subsequently escalated their privileges to root level by enabling Set User ID (SUID) permissions.

Following the initial access, they introduced a new Sawfly web shell and Bareclaw tunneler malware, erased logs to avoid detection, and navigated laterally within the victim's network by utilizing compromised Administrator credentials to initiate remote sessions on subordinate systems.

"Once a foothold was established through the web shell, the actor escalated from the web service account to root-level control of the appliance host. This provided them access to every credential stored or managed by the appliance and enabled them to alter files that would persist through reboots and configuration resets," Mandiant emphasized.

"Any appliance that was accessible from the internet while running a vulnerable version during the exploitation window should be regarded as potentially compromised until a thorough review has been conducted."

Shadowserver, an internet threat monitoring entity, is currently tracking over 1,400 BeyondTrust remote support instances exposed online, although it does not specify how many of these have been secured or whether they are used as honeypots.

Attack chain and threat actor background

Armory Castle has a history of targeting zero-day vulnerabilities within network edge appliances, including Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805 and CVE-2024-21887, followed by CVE-2025-0282), since at least October 2023. Their aim has been to penetrate enterprise networks and deploy new customized malware.

Volexity, a threat intelligence firm, reported in January 2024 that UNC5221 had compromised over 2,100 Ivanti appliances by employing the GiftedVisitor webshell in operations that combined the exploits of CVE-2023-46805 and CVE-2024-21887.

"In previous campaigns, ARMORY CASTLE has executed widespread and opportunistic exploitation after vulnerabilities were disclosed publicly. They have exploited vulnerabilities selectively as zero-days, racing to infiltrate target organizations before patches are implemented," Mandiant noted. "It is possible that we may witness similar extensive exploitation attempts associated with CVE-2026-102764."

Recent BeyondTrust vulnerability history

CVE-2026-102764 marks the latest in a series of vulnerabilities affecting BeyondTrust that have been exploited by threat actors in recent years. Recently, another critical remote code execution vulnerability (CVE-2026-1731) was leveraged by attackers against Remote Support and Privileged Remote Access appliances, enabling them to establish WebSocket channels for ransomware deployment.

Additionally, the Chinese state-backed hacking group Silk Typhoon is believed to have exploited two zero-days (CVE-2024-12356 and CVE-2024-12686) to breach BeyondTrust's systems. They utilized a stolen API key to compromise 17 Remote Support SaaS instances, including one associated with the U.S. Treasury Department.

In this same operation, Silk Typhoon also targeted the Office of Foreign Assets Control (OFAC), the body responsible for overseeing U.S. sanctions programs, as well as the Committee on Foreign Investment in the United States (CFIUS), which assesses foreign investments for potential national security concerns.

BeyondTrust provides identity security services to over 20,000 clients globally, which include government entities and 75% of Fortune 100 companies.