BeyondTrust Remote Support Zero-Day Exploited Since August: What IT Teams Should Do Now

This is a briefing for IT and security teams that run remote support gateways or buy them for their service desks. Facts below come from the sources listed at the end, which agree on the core details and differ slightly on one patch date.

What Happened

On October 15, 2026, BeyondTrust disclosed CVE-2026-102764, a critical flaw in its Remote Support product that attackers had been exploiting as a zero-day since late August. A suspected China-linked espionage group is blamed, according to several security outlets.

According to The Hacker News, the bug is an improper origin validation issue in an internal messaging component, rated CVSS 9.3, that lets a remote attacker perform file operations on an affected appliance. BleepingComputer reports that BeyondTrust patched its hosted Remote Support and Privileged Remote Access customers around October 8, while The Hacker News and Cybersecurity Dive place the SaaS patch on October 9. Reports agree on the broader timeline: first exploitation on August 29, 2026, discovery during a Mandiant investigation in late September, and public disclosure on October 15.

Google and Mandiant attribute the activity to a group tracked as Armory Castle, also known as UNC5221 and, to CrowdStrike, Warp Panda. Reports say it has used zero-days in other edge products, including Ivanti Connect Secure, which we covered in our Ivanti Connect Secure zero-day coverage.

Who Is Affected

Self-hosted Remote Support appliances running versions 24.3.1 through 26.2.3 are affected and need the BT26-05-RS patch applied manually. Versions older than 24.3.1 must be upgraded first. SaaS customers were patched by the vendor.

• Self-hosted Remote Support: patch immediately, or confirm automatic upgrades are enabled.
• Privileged Remote Access: reports say it shares the affected code and received a precautionary patch, although BeyondTrust's testing found no way to exploit it.
• Exposure: BleepingComputer cites Shadowserver tracking more than 1,400 internet-exposed BeyondTrust remote support instances.

Cybersecurity Dive reports that CISA added the flaw to its Known Exploited Vulnerabilities catalog, which sets a federal deadline for civilian agencies. Private organizations should treat that listing as a signal to prioritize the fix.

How the Attack Worked

Mandiant's analysis, summarized by the sources above, shows attackers using the flaw to upload a file, escalate from a low-privilege web service account to root, steal credentials, and tunnel into victim networks. They used a web shell called Sawfly and a SOCKS5 tunneler called Bareclaw, and they deleted logs to hide their tracks.

The practical lesson is that remote support appliances are high-value targets because they hold credentials and sit at the network edge. A compromised appliance can give an attacker the same reach as your support technicians. Reports say few victims have been confirmed so far, but Google warns of possible widespread exploitation now that the bug is public.

Why It Matters for B2B SaaS and IT Teams

Remote access tools are privileged infrastructure that holds credentials and reaches deep into corporate networks. Any self-hosted support gateway deserves the same urgency as VPNs and firewalls: inventory it, restrict exposure, patch fast and log centrally.

Organizations running BeyondTrust should check the vendor advisory BT26-05 for their product line.

The incident also shows why hosted versus self-hosted is a real buying criterion. SaaS customers received the fix before disclosure, while self-hosted teams had to act themselves. When evaluating products in our Remote Support Software and Privileged Access Management categories, ask vendors how quickly they patch, how they notify customers and whether logs can be forwarded off the appliance.

What To Do Now

Patch first, then investigate. Any internet-reachable appliance that ran a vulnerable version during the exploitation window should be treated as potentially compromised until reviewed, as Mandiant advises according to Cybersecurity Dive and The Hacker News.

1. Identify every BeyondTrust Remote Support and Privileged Remote Access instance, including forgotten test systems.
2. Apply BT26-05-RS or the latest supported release; upgrade first if you run a version older than 24.3.1.
3. Restrict administrative interfaces to trusted networks and remove unnecessary internet exposure.
4. Forward appliance system logs and session events to your SIEM, since the actor has deleted logs in past intrusions.
5. Hunt for indicators published by the researchers, such as the Sawfly web shell and unexpected SUID binaries, and rotate credentials stored on the appliance if you suspect compromise.
6. Use your vulnerability management software to confirm patch status across the fleet.

Teams comparing remote access options can also review our Remote Access Software category and our recent PAN-OS zero-day briefing for similar edge-device guidance.

Frequently Asked Questions

Do I need to patch if I use BeyondTrust SaaS?
SaaS customers were patched by BeyondTrust before disclosure, according to the reports. You should still confirm with the vendor, review your own logs and apply any required patch to self-hosted Privileged Remote Access components.

How do I know if my Remote Support appliance was compromised?
Treat internet-reachable vulnerable appliances as potentially compromised until reviewed. Check for the indicators published by researchers, unexpected SUID binaries and deleted logs, and review credentials stored on the appliance. Engage incident response if you find signs.

Should we replace our remote support tool after this?
A single vulnerability does not by itself justify replacement, but it is a good moment to evaluate patch speed, SaaS versus self-hosted risk and logging. Compare options with a written security questionnaire before deciding.