BeyondTrust patches zero-day exploited in attacks since August

CVE-2026-102764 is a critical authentication bypass vulnerability in BeyondTrust Remote Support (RS) affecting versions 26.2.3 and earlier. It enables unprivileged remote attackers to perform file operations on unpatched appliances. The flaw has been exploited in the wild since late August 2026 by the Armory Castle threat actor, known for targeting network edge appliances with zero-days. Attackers leveraged the vulnerability to gain initial access, escalate privileges to root by enabling SUID permissions, deploy Sawfly web shell and Bareclaw tunneler malware, erase logs, and move laterally using compromised credentials. BeyondTrust patched the issue for all Remote Support and Privileged Remote Access SaaS customers on October 8, 2026. Self-hosted deployments require manual patching if automatic updates are disabled. The vulnerability is part of a pattern of recent zero-day exploits targeting BeyondTrust appliances by Chinese state-backed groups.

Successful exploitation allows remote attackers to bypass authentication and perform unauthorized file operations, leading to initial access and root privilege escalation on affected appliances. Attackers gain full control over the appliance host, access all stored or brokered credentials, modify persistent files, deploy malware, erase logs to evade detection, and move laterally within victim networks. This compromises the confidentiality, integrity, and availability of the affected systems and potentially the broader network environment.

BeyondTrust has released an official patch for CVE-2026-102764. SaaS customers have been automatically patched as of October 8, 2026. Self-hosted customers must apply the patch manually if automatic updates are not enabled. It is critical to update all vulnerable BeyondTrust Remote Support appliances to the fixed version immediately. Any appliance exposed to the internet during the exploitation window should be treated as potentially compromised and undergo thorough security review.