BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust patched CVE-2026-102764, a Remote Support authentication bypass exploited since August by China-linked Armory Castle.
BeyondTrust patched CVE-2026-102764, a critical authentication bypass in Remote Support 26.2.3 and earlier that lets unprivileged remote attackers perform file operations. Mandiant and Google Threat Intelligence Group say China-nexus Armory Castle, also UNC5221 and CrowdStrike's Warp Panda, exploited it since late August, gained root through SUID permissions, deployed the Sawfly web shell and Bareclaw tunneler, wiped logs, and moved laterally with stolen administrator credentials. SaaS customers were patched on October 8, while self-hosted systems require a manual update. Shadowserver tracks more than 1,400 exposed instances, and Mandiant warned exploitation may broaden now that the flaw is public.