Key points
- CVE-2026-102764 allows unprivileged attackers to bypass authentication and perform file operations on Remote Support versions 26.2.3 or earlier.
- SaaS customers were patched on 8 October, but self-hosted installations require manual updates if automatic updates are disabled.
- The Armory Castle espionage group exploited the flaw since late August to gain root privileges and deploy malware.
Unauthorised remote attackers can now bypass authentication on vulnerable BeyondTrust Remote Support appliances. This capability allows them to perform file operations and escalate privileges to root. The flaw affects versions 26.2.3 and earlier. Once inside, attackers accessed every credential stored or brokered by the appliance. They could also modify files that survive system reboots and configuration resets.
In plain English
The vulnerability is an authentication bypass. It lets an attacker skip the login process entirely. They do not need valid user credentials to interact with the system. Instead, they exploit a weakness in how the appliance handles remote connections. This gives them the ability to read, write or delete files on the device. For managed service providers, this means the security boundary of the remote support tool was breached.
The background
BeyondTrust warned customers on Thursday about the critical flaw. The issue has been exploited in zero-day attacks since late August. Mandiant and Google Threat Intelligence Group track the attacker as Armory Castle. CrowdStrike refers to the same group as Warp Panda. The actor is suspected to have China-nexus espionage links. Mandiant researchers spotted the initial attacks and detailed the intrusion methods.
What changes now
BeyondTrust patched the security issue for all SaaS customers on 8 October. Self-hosted installations must be patched manually if automatic updates are not enabled. Shadowserver tracks over 1,400 instances exposed online. It provides no information on how many are secured or are honeypots. Any appliance reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until reviewed.
The attacker's path
Teams usually face initial access challenges when remote support tools are exposed. This weakness allows bypassing identity checks, serving as a direct entry point. Attackers typically escalate privileges immediately after gaining a foothold. They then deploy persistent tools to maintain access and move laterally. Check whether your remote support instances are internet-facing. Verify that authentication mechanisms are not bypassed by unprivileged users. Monitor for unexpected file changes or new administrative accounts.
What to do and how to stay safe: BeyondTrust
- Verify your BeyondTrust Remote Support version and apply the latest patch immediately, especially for self-hosted instances.
- Review logs for signs of unauthorised file operations or privilege escalation attempts from late August onwards.
- Check for the presence of unknown web shells or tunneler malware on compromised appliances.
- Assume any internet-facing vulnerable appliance is compromised until a thorough forensic review confirms otherwise.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which BeyondTrust products are affected by this vulnerability?
BeyondTrust Remote Support versions 26.2.3 or earlier are affected. Privileged Remote Access SaaS customers were also patched.
Is there a patch available for self-hosted installations?
Yes, but self-hosted installations must be patched manually if automatic updates are not enabled. SaaS customers were patched on 8 October.
Who is exploiting this vulnerability?
The Armory Castle espionage actor, also known as Warp Panda, has been exploiting the flaw since late August.
