BeyondTrust has warned customers to patch a critical flaw in its Remote Support product that attackers were already exploiting as a zero-day. The bug, CVE-2026-102764 (CVSS 9.3 according to The Hacker News), is an authentication bypass: the appliance did not properly check where certain internal messages came from, which lets an unprivileged remote attacker perform file operations on an unpatched appliance. Remote Support is the tool IT and help desks use to open remote sessions on staff computers, so a compromised appliance is a path into everything it can reach.
According to BeyondTrust and Mandiant, a suspected China-nexus espionage group tracked as Armory Castle (formerly UNC5221, called Warp Panda by CrowdStrike) first used the flaw against a single self-hosted appliance on August 29, 2026. Mandiant describes the attackers installing a PHP web shell called SAWFLY, gaining root on the appliance host, reading the credentials the appliance stores, and then using administrator access to open remote sessions on downstream systems. They also deployed a SOCKS5 tunneling tool called BARECLAW and deleted logs. Mandiant warns that this group has a history of switching to broad, opportunistic exploitation once a bug becomes public, as it did with earlier Ivanti and Citrix zero-days. Shadowserver tracks more than 1,400 BeyondTrust remote support instances exposed online, though it does not say how many are still unpatched.
How to check if you’re affected
Affected products are self-hosted BeyondTrust Remote Support appliances. BleepingComputer reports versions 26.2.3 and earlier are affected; The Hacker News says self-hosted versions 24.3.1 through 26.2.3 should apply the BT26-05-RS patch, and versions older than 24.3.1 must first upgrade to a newer version. SaaS customers were patched by BeyondTrust (BleepingComputer dates this October 8, The Hacker News October 9), so no action is needed there.
- Apply the BT26-05-RS patch if automatic updates are off. BeyondTrust also released the patch for self-hosted Privileged Remote Access (PRA) as a precaution, because PRA shares the affected code, although its own testing found no way to exploit PRA.
- Mandiant says any appliance that was internet-reachable on a vulnerable version during the exploitation window should be treated as potentially compromised until reviewed. Reported indicators include a copy of
/bin/shat/usr/bin/dbus-authdwith the SUID bit set, edits to/ns/config/haproxy.confthat expose the BARECLAW proxy, and missing system or web server logs. - Mandiant says the attackers reached downstream systems by launching remote sessions from the appliance’s Jump Item list, so review recent sessions there. Because the attackers could read every credential the appliance stored or brokered, rotating those credentials is the cautious follow-up (our suggestion, not a vendor instruction).