BeyondTrust issued an urgent advisory Thursday directing customers to apply fixes for a critical vulnerability in its Remote Support product line. The flaw, tracked as CVE-2026-102764, represents an authentication bypass that permits unprivileged remote attackers to execute file operations on unpatched systems running Remote Support 26.2.3 or earlier.
Remote Support serves as BeyondTrust's enterprise-grade offering for IT service desks, help desks, and customer support operations seeking remote troubleshooting capabilities. The company deployed patches for all SaaS-hosted Remote Support and Privileged Remote Access customers on October 8, though organizations running self-hosted deployments must manually apply updates unless automatic patching is configured.
Attackers have been actively exploiting this vulnerability since late August in the wild. Security researchers from Mandiant and Google Threat Intelligence Group identified the threat actor as "Armory Castle" (previously designated UNC5221), while CrowdStrike tracks the same group as "Warp Panda." Intelligence suggests the group operates from China and specializes in espionage operations.
Attack chain and lateral movement
According to Mandiant's analysis, Armory Castle leveraged the flaw to establish initial access and subsequently escalated privileges to root level by enabling Set User ID (SUID) permissions. The attackers then deployed the Sawfly web shell and Bareclaw tunneler malware, erased system logs to avoid detection, and moved across the victim environment using stolen Administrator credentials to launch remote sessions on additional systems.
After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host. This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset.
Mandiant
Mandiant researchers emphasized the severity of compromise, cautioning that any appliance accessible from the internet running a vulnerable version during the exploitation window should be presumed compromised pending thorough review.
Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed.
Mandiant
Shadowserver, an internet threat monitoring service, has catalogued more than 1,400 BeyondTrust remote support instances publicly exposed online, though the data does not indicate how many have been remediated or represent honeypots.
Pattern of targeting network edge appliances
Armory Castle has demonstrated a consistent focus on exploiting zero-day vulnerabilities affecting network edge appliances since at least October 2023. The group has previously targeted Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282) in campaigns designed to compromise enterprise networks and deploy custom malware variants.
Threat intelligence firm Volexity reported in January 2024 that UNC5221 had compromised more than 2,100 Ivanti appliances using the GiftedVisitor webshell. That campaign chained together the CVE-2023-46805 and CVE-2024-21887 zero-day flaws.
In past campaigns, ARMORY CASTLE has conducted widespread and opportunistic exploitation following the public disclosure of vulnerabilities it had exploited selectively as zero-days, racing to infiltrate target organizations before patches are deployed. It is possible that we will observe similar widespread exploitation attempts associated with CVE-2026-102764.
Mandiant
Broader BeyondTrust vulnerability landscape
CVE-2026-102764 represents the latest in a series of BeyondTrust flaws that threat actors have weaponized. Recently, attackers exploited CVE-2026-1731, another critical remote code execution flaw in Remote Support and Privileged Remote Access appliances, to establish WebSocket channels and distribute ransomware payloads.
Chinese state-sponsored group Silk Typhoon has also targeted BeyondTrust infrastructure, exploiting two zero-days (CVE-2024-12356 and CVE-2024-12686) to breach the company's systems. The attackers obtained a stolen API key that enabled them to compromise 17 Remote Support SaaS instances, including the deployment serving the U.S. Treasury Department.
In the same operation, Silk Typhoon targeted the Office of Foreign Assets Control (OFAC), which manages U.S. sanctions enforcement, and the Committee on Foreign Investment in the United States (CFIUS), responsible for reviewing foreign investments for national security implications.
BeyondTrust maintains identity security services for more than 20,000 customers globally, encompassing government agencies and 75 percent of Fortune 100 companies.