BeyondTrust has patched an authentication bypass in its Remote Support product that attackers exploited as a zero-day for about four weeks before the company was first alerted to it. The flaw, tracked as CVE-2026-102764, affects Remote Support (RS) 26.2.3 and earlier. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), it "could allow a remote attacker to perform file operations on the appliance."

According to The Record, BeyondTrust's investigation, prompted in part by a warning from Mandiant, traced the activity back to a zero-day exploited on August 29. Mandiant and Google Threat Intelligence Group (GTIG) track the group behind the attacks as Armory Castle, formerly UNC5221, and BeyondTrust confirmed Mandiant's assessment that it is a Chinese "state-sponsored espionage operation focused on long-term intelligence collection." BleepingComputer reports that CrowdStrike tracks the same actor as Warp Panda.

CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on October 16 and gave federal civilian agencies until October 19, which is today, to act. The KEV entry also carries a forensic triage flag. That means CISA expects affected agencies to check for compromise, not just install the patch.

Timeline

  • October 2023: Armory Castle/UNC5221 has been active since at least this date, according to Google as reported by The Record.
  • August 29, 2026: The date The Record reports the zero-day was first exploited.
  • September 27: BeyondTrust is first alerted to the issue, per The Record.
  • October 8: BeyondTrust patches its SaaS-hosted Remote Support and Privileged Remote Access customers.
  • October 16: BeyondTrust issues its warning (advisory BT26-05). BleepingComputer and The Record report the zero-day. CISA adds the CVE to KEV with a due date of October 19.
  • October 19: The KEV remediation deadline for federal agencies.

What the flaw is

CISA lists CVE-2026-102764 as a "BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability," mapped to CWE-290. This weakness class covers cases where a system accepts a forged identity or origin claim in place of real authentication. The practical result, as CISA describes it, is that a remote attacker can perform file operations on the Remote Support appliance. BleepingComputer describes the attackers as unprivileged.

Remote Support appliances let IT teams access and troubleshoot remote endpoints, so the appliance sits in a privileged position on the networks that run it. BleepingComputer reports that BeyondTrust has more than 20,000 customers, including government agencies and 75% of the Fortune 100.

BeyondTrust's Privileged Remote Access (PRA) product shares the affected code. BeyondTrust said its internal testing "has not identified any way for an attacker to exploit this vulnerability in Privileged Remote Access," but that "out of an abundance of caution" it released the patch for PRA as well and recommends self-hosted PRA customers apply it immediately, according to BleepingComputer.

What the attackers did

Based on Mandiant's observations, BleepingComputer describes a full intrusion chain after initial access. The attackers escalated to root on the appliance, deployed a web shell and tunneling malware, wiped logs to evade detection, and moved laterally using compromised administrator credentials to open remote sessions on downstream systems.

Mandiant's findings, reported by both outlets, include two details that matter for cleanup. First, root-level control gave the attackers access to every credential the appliance stored or brokered. On a remote-support system, that can include credentials used to reach the machines it manages. Second, they could modify files that survive reboots and configuration resets. Restarting or resetting an appliance may not remove an attacker who is already inside.

Mandiant calls the custom malware used in the campaign Sawfly, a web shell, and Bareclaw, a tunneler. According to BeyondTrust, as quoted by The Record, Armory Castle's documented targets include legal services, software-as-a-service providers, business-process outsourcers, technology companies, and government.

The Record reports that other cybersecurity firms, including watchTowr, have since confirmed exploitation.

How many systems are exposed

Shadowserver tracks more than 1,400 Remote Support instances exposed to the internet, according to BleepingComputer. That count measures exposure, not compromise. Shadowserver does not say how many of those instances have already been secured or are honeypots.

Mandiant warned that the activity may widen: "It is possible that we will observe similar widespread exploitation attempts associated with CVE-2026-102764." BeyondTrust, quoted by The Record, said that once a vulnerability is public, the actor "typically moves to broad exploitation of every instance still unpatched."

Who has to patch, and who doesn't

The patching burden depends on how a customer runs the product:

  • SaaS customers of Remote Support and PRA were patched by BeyondTrust on October 8. That patch does not address any activity that took place before that date.
  • Self-hosted appliances must be patched manually unless automatic updates are enabled, per BleepingComputer.
  • Self-hosted PRA deployments received the same precautionary fix, which BeyondTrust recommends applying immediately.

For federal agencies, CISA's required action is to apply mitigations according to vendor instructions, follow BOD 26-04 and CISA's Forensics Triage Requirements, or stop using the product if mitigations are unavailable. CISA lists "knownRansomwareCampaignUse" for this CVE as "Unknown."

On the same day, CISA also added Fortinet CVE-2025-61624, a path traversal flaw affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, with the same October 19 due date.

What It Means for Defenders

Mandiant's main guidance is that a patch alone does not resolve the problem: "Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed." Combined with the persistence and credential theft described above, that leads to these steps:

  1. Find your instances. Inventory every Remote Support and PRA deployment, including lab and secondary appliances. Note which ones are reachable from the internet.
  2. Patch self-hosted appliances now. Any Remote Support install at version 26.2.3 or earlier is affected. Apply the update referenced in advisory BT26-05, and confirm whether automatic updates were actually enabled and applied rather than assuming they were. Update self-hosted PRA as well.
  3. Check the KEV deadline. Federal civilian agencies must meet the October 19 due date under BOD 26-04, including the forensic triage requirements. Other organizations should treat that date as a reasonable benchmark.
  4. Do forensic triage, not just patching. Review any appliance that was internet-facing on a vulnerable version at any point since August 29. Mandiant observed log wiping, so missing or truncated logs are a finding in themselves. Where possible, compare appliance logs against off-box telemetry such as firewall, proxy, and SIEM data.
  5. Rotate credentials stored on the appliance. Mandiant says the attackers gained access to every credential the appliance stored or brokered. Rotate them all, prioritizing administrator and domain accounts. Also review remote sessions and authentication activity from the appliance to downstream systems for signs of lateral movement.
  6. Don't rely on a reboot or reset. The attackers could modify files that survive both. If you cannot rule out compromise, work with BeyondTrust on remediation, including a rebuild if needed.
  7. Look for the reported tradecraft. Hunt for web shells, unexpected tunneling or outbound connections from the appliance, and any indicators of compromise that BeyondTrust and Mandiant publish for Sawfly and Bareclaw.
  8. Reduce exposure. If the remote-support console does not need to be reachable from the open internet, restrict access to it.

SaaS customers are not exempt from review either. Their instances were patched on October 8, but exploitation began more than five weeks earlier. Those customers should ask BeyondTrust whether their tenant showed signs of compromise during that period.

Sources