BeyondTrust patches zero-day exploited since late August
Summary
BeyondTrust says attackers have exploited an authentication bypass in Remote Support since late August. The flaw affects versions 26.2.3 and earlier; SaaS customers were patched, while self-hosted installations may need manual updates.
Key points
- CVE-2026-102764 lets unprivileged remote attackers perform file operations on vulnerable BeyondTrust Remote Support appliances.
- The flaw affects Remote Support version 26.2.3 and earlier; BeyondTrust patched Remote Support and Privileged Remote Access SaaS customers on October 8.
- Self-hosted installations may require manual patching if automatic updates are disabled.
- Mandiant says attackers used the flaw for initial access, elevated privileges to root, deployed web shell and tunneler malware, wiped logs, and moved laterally using compromised administrator credentials.
- The activity is attributed to a suspected China-nexus espionage actor tracked as Armory Castle by Mandiant and GTIG, and Warp Panda by CrowdStrike.
- Shadowserver tracks more than 1,400 exposed BeyondTrust remote support instances but does not say how many are patched or honeypots.
Article Details
- Vulnerability Types
- Authentication bypass
- Severity
- Critical
- Affected Versions
- BeyondTrust Remote Support (RS) 26.2.3 or earlier
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1003 · OS Credential DumpingMandiant reported the attackers gained access to credentials stored or brokered by the compromised appliance.T1021 · Remote ServicesAttackers used compromised Administrator credentials to open remote sessions on downstream systems and move laterally.T1070.002 · Clear Linux or Mac System LogsAttackers wiped logs to evade detection.T1505.003 · Web ShellAttackers deployed the Sawfly web shell to establish a foothold on compromised appliances.T1548.001 · Setuid and SetgidAttackers enabled Set User ID (SUID) permissions to escalate privileges to root on compromised appliances.
CVE
People
Threat Actors
Malware
BARECLAWNext, they deployed new Sawfly web shell and Bareclaw tunneler malware, wiped logs to evade detection, and moved laterally through the victim's network using compromised Administrator credentials by opening remoteGiftedVisitoralso said in January 2024 that UNC5221 had backdoored more than 2,100 Ivanti appliances using the GiftedVisitor webshell in attacks chaining the CVE-2023-46805 and CVE-2024-21887 zero-days.SAWFLYNext, they deployed new Sawfly web shell and Bareclaw tunneler malware, wiped logs to evade detection, and moved laterally through the victim's network using compromised Administrator credentials by opening remote
Vendors
Products
BeyondTrust Privileged Remote AccessBeyondTrust patched the security issue for all Remote Support and Privileged Remote Access SaaS customers on October 8, but self-hosted installations must be patched manually if automatic updates are not enabled.BeyondTrust Remote SupportBeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August.