BeyondTrust patches zero-day exploited in attacks since August

A zero-day vulnerability is a software weakness that attackers exploit before defenders have had time to fix it. The name highlights the lack of preparation time. It is dangerous because organizations may be exposed while the flaw remains undisclosed or unpatched. Active exploitation makes the risk immediate, not theoretical.

CVE-2026-102764 shows the danger clearly. Attackers used the authentication bypass against BeyondTrust Remote Support appliances from late August. The flaw allowed unprivileged remote attackers to perform file operations. The attackers then used compromised appliances as footholds inside victim networks.

BeyondTrust released patches on October 8, but self-hosted customers must install them manually when automatic updates are disabled. Internet-reachable appliances on vulnerable versions should be treated as potentially compromised and reviewed. The suspected China-nexus actor Armory Castle may also attempt wider exploitation after disclosure.

The vulnerability affects BeyondTrust Remote Support appliances running version 26.2.3 or earlier. BeyondTrust also released the patch for Privileged Remote Access because PRA shares the affected code. The company said internal testing found no exploitation path in PRA, but recommended that self-hosted PRA customers patch immediately as a precaution.

BeyondTrust patched Remote Support and Privileged Remote Access SaaS customers on October 8. SaaS customers therefore did not need to perform the update themselves. The risk is greatest for installations still running vulnerable software and reachable by attackers over the internet.

Self-hosted installations require manual action when automatic updates are not enabled. BeyondTrust warned customers to apply the patch, and said appliances exposed during the exploitation window should be treated as potentially compromised until reviewed. The flaw is an actively exploited authentication bypass.

Armory Castle, also called UNC5221 by Mandiant and GTIG, exploited the authentication bypass for initial access. The group then escalated from the appliance's web service account to root-level control. This turned a remote entry into control over the appliance and its stored or brokered credentials.

Mandiant said the attackers enabled Set User ID, or SUID, permissions to obtain root privileges. They deployed a new Sawfly web shell and Bareclaw tunneler malware. They also wiped logs to make investigation harder. Using compromised Administrator credentials, they opened remote sessions on downstream systems and moved laterally.

Root-level control let the attackers modify files that survived reboot and configuration reset. The appliance also gave them access to every credential it stored or brokered. BeyondTrust warned that any vulnerable appliance reachable from the internet during exploitation should be considered potentially compromised until reviewed.

The exposed-infrastructure count shows how many potential entry points attackers can find online. Shadowserver tracks over 1,400 BeyondTrust remote support instances exposed to the internet. That number does not show how many are patched, compromised, or operating as honeypots, so it is not a confirmed victim count.

BeyondTrust has a much larger overall footprint. The company provides identity security services to more than 20,000 customers worldwide. Its customers include government agencies and 75% of Fortune 100 companies. A compromise can therefore affect organizations with valuable systems and sensitive credentials.

The article gives no figure for how many exposed instances have been secured. It also does not say how many were attacked successfully. Because Armory Castle exploited vulnerable appliances in the wild, organizations with internet-facing installations must check versions, patch status, and possible compromise rather than assume exposure is harmless.

A remote-support appliance can sit between administrators, service desks, and downstream systems. If attackers control it, they may gain access to credentials and remote sessions handled by the appliance. The risk is much greater when the device stores or brokers credentials for other systems.

In this campaign, Armory Castle escalated to root and gained access to every credential the appliance stored or brokered. The attackers deployed a Sawfly web shell and Bareclaw tunneler, wiped logs, and used compromised Administrator credentials to open remote sessions on downstream systems. This enabled lateral movement through the victim's network.

Root control also allowed attackers to modify files that survived reboot and configuration reset. That can help maintain access after normal recovery actions. BeyondTrust advised treating any internet-reachable appliance running a vulnerable version during the exploitation window as potentially compromised until security teams complete a review.

Internet-facing network appliances are attractive targets because they sit at the edge of enterprise networks and accept remote connections. A successful exploit can provide initial access without first compromising an employee or internal server. Armory Castle has repeatedly targeted such appliances since at least October 2023.

Its earlier targets included Citrix NetScaler and Ivanti Connect Secure appliances. In the BeyondTrust campaign, the group used a zero-day authentication bypass, escalated privileges, deployed custom malware, and moved through victim networks. These appliances can therefore become powerful entry points and operational platforms.

Mandiant said Armory Castle has previously exploited vulnerabilities selectively as zero-days, then conducted widespread and opportunistic exploitation after public disclosure. The group races to infiltrate organizations before patches are deployed. Mandiant said similar widespread exploitation may follow CVE-2026-102764, making rapid patching and review especially important.

Authentication is the process of checking whether a user or system is allowed to access something. A bypass lets an attacker get past that check without valid authorization. Privilege escalation means moving from limited permissions to more powerful ones. Root access is the highest-level administrative control on systems such as these appliances.

In the reported attack, unprivileged remote attackers used the authentication bypass to perform file operations. Armory Castle then enabled Set User ID permissions, escalating from the web service account to root-level control. This sequence converted limited access into control of the appliance host.

Root gives an attacker broad authority to read sensitive data, alter files, install software, change permissions, and affect other users or services. Here, root control exposed credentials stored or brokered by the appliance and allowed persistent file changes. The attackers also deployed malware, erased logs, and used Administrator credentials for lateral movement.