BeyondTrust patches a Remote Support zero-day exploited since August
CVE-2026-102764 let attackers skip authentication and reach root on Remote Support and Privileged Remote Access appliances for weeks before the 15 October patch.
BeyondTrust disclosed CVE-2026-102764 on 15 October, a critical flaw in Remote Support and Privileged Remote Access appliances that had already been exploited as a zero-day since late August. The bug scores 9.3 on CVSS: internal components failed to validate the origin of messages they received, letting an unauthenticated attacker perform file operations on the appliance. It affects Remote Support versions up to 26.2.3.
Mandiant traced the exploitation to a China-linked group it tracks as Armory Castle, formerly known as UNC5221 and also called Warp Panda. The group used the flaw to upload a file, escalate from an unprivileged web service account to root, and plant a PHP webshell it calls SAWFLY, typically within about eleven minutes of initial access, before tunnelling further into the network with stolen credentials. BeyondTrust auto-patched SaaS tenants on 9 October; self-hosted Remote Support and PRA installs need the BT26-05 patches applied manually if automatic updates are switched off.
Why it matters: Remote Support appliances sit inside the network with privileged access by design, so a working authentication bypass there is a direct route to domain-wide compromise. Mandiant notes this group has previously moved from selective zero-day use to broad opportunistic scanning once a bug becomes public, so self-hosted admins who haven’t patched should treat this as urgent, not routine.
The caveat: the full technical breakdown of the bypass hasn’t been published, so this account leans on BeyondTrust’s and Mandiant’s own summaries rather than a public proof-of-concept writeup.