Cybersecurity

BeyondTrust Patches Zero-Day Exploit Active Since August

BeyondTrust has urged customers to apply security patches for a critical remote support flaw actively abused in the wild by a suspected China-nexus espionage actor since August.

Radwan AbdulhadiEditor and technology writer

Published: October 16, 2026 · Updated: October 16, 2026 · 3 min read

BeyondTrust Patches Zero-Day Exploit Active Since August — Image: BleepingComputer

Critical Zero-Day Flaw Discovered in BeyondTrust Remote Support

BeyondTrust recently issued urgent security advisories warning customers to patch a critical flaw affecting its enterprise-grade Remote Support platform. The vulnerability, officially tracked as CVE-2026-102764, has been actively targeted in zero-day attacks since late August.

Remote Support serves as a vital enterprise solution for IT service desks and customer support teams needing to troubleshoot issues remotely. According to technical disclosures, the underlying security issue functions as an authentication bypass vulnerability, enabling unprivileged remote attackers to execute file operations on unpatched network appliances running version RS 26.2.3 or earlier.

Attribution to China-Nexus Threat Actor Armory Castle

While BeyondTrust shared limited initial technical details about the precise mechanics of the vulnerability, threat intelligence investigators have linked the campaign to established nation-state operations. The active exploitation has been attributed to a suspected China-nexus espionage actor tracked by Mandiant and the Google Threat Intelligence Group as Armory Castle, which was previously known as UNC5221. Cybersecurity provider CrowdStrike monitors the exact same group under the designation Warp Panda.

According to findings published by Mandiant, the threat actors exploited the vulnerability to achieve initial network footholds before escalating privileges to root access on compromised machinery by altering Set User ID permissions. Following initial infiltration, the attackers deployed custom tooling such as Sawfly web shells and Bareclaw tunnelers, subsequently clearing system logs to evade immediate forensic detection.

Scope of Exposure and Historical Attack Patterns

Internet threat monitoring data from Shadowserver highlights that more than 1,400 individual BeyondTrust remote support instances remain directly exposed across the public internet. However, threat intelligence trackers note that exact metrics detailing how many of these systems have been successfully hardened or isolated remain unavailable.

Armory Castle has an extensive history of targeting high-profile network edge equipment. The group previously targeted critical zero-day vulnerabilities in enterprise infrastructure platforms, including historical exploits tracked against Citrix NetScaler environments and multiple flaws affecting Ivanti Connect Secure appliances, such as CVE-2023-4966.

Attack chain (Mandiant / GTIG) · Source: BleepingComputer

Broader Industry Impact and Historical Context

The threat group's historical campaigns involved widespread compromise of network perimeters. Previous research by security organizations like Volexity indicated that the same hacking collective backdoored over 2,100 enterprise Ivanti gateways during major campaigns by chaining vulnerabilities like CVE-2023-46805 and CVE-2024-21887.

Additional security reports have continued to monitor the evolving techniques of this adversary. Google researchers previously analyzed subsequent zero-day campaigns impacting virtual private network products, linking related infrastructure exploits to the same threat lineage, including incidents involving CVE-2025-0282.

Remediation Guidance for System Administrators

BeyondTrust confirmed that automatic updates successfully secured all managed SaaS installations of Remote Support and Privileged Remote Access by October 8. However, organizations utilizing self-hosted on-premises deployments must manually install the latest software updates to completely neutralize the security risk.

Cybersecurity experts strongly advise that any enterprise appliance running a vulnerable version that was accessible from the public internet during the active exploitation window must be handled as potentially compromised. Comprehensive forensic investigations, log audits, and credential rotation protocols are recommended until network administrators thoroughly verify the security posture of their internal infrastructure.