BeyondTrust patches zero-day exploited in attacks since August

BeyondTrust has issued a fix for a critical authentication-bypass flaw in its Remote Support product, CVE-2026-102764, after discovering it had been abused in real-world attacks since late August. The bug allows attackers without credentials to perform file operations on vulnerable appliances running Remote Support 26.2.3 and earlier, and researchers say a suspected China-linked espionage group—known as Armory Castle (previously UNC5221) to Mandiant/GTIG, and as Warp Panda to CrowdStrike—leveraged it to gain root access, deploy the Sawfly web shell and Bareclaw tunneling tool, erase logs, and move laterally using stolen admin credentials. BeyondTrust rolled out the patch to all SaaS customers on October 8, but self-hosted users without automatic updates must apply it manually; Shadowserver counts over 1,400 internet-facing instances still exposed. This marks yet another zero-day hitting BeyondTrust, following prior incidents involving CVE-2026-1731 and the Silk Typhoon-linked breaches via CVE-2024-12356 and CVE-2024-12686.