BeyondTrust has confirmed that a flaw in its Remote Support software, tracked as CVE-2026-102764, was exploited as a zero-day starting around 29 August — more than six weeks before a patch existed. Google's Threat Intelligence Group and Mandiant attribute the attacks to a China-nexus espionage group they call Armory Castle, previously tracked as UNC5221 and known to other researchers as Warp Panda. The bug is an authentication bypass that lets an unauthenticated attacker perform file operations on the appliance — no credentials needed. In observed intrusions, the attackers used it to drop a small PHP webshell nicknamed SAWFLY within roughly eleven minutes of gaining a foothold, then escalated from the low-privileged web service account all the way to root.
Remote Support is the kind of tool IT departments and managed service providers use every day to remotely view and control the computers they support — BeyondTrust says over 20,000 organisations run it, including around three-quarters of the Fortune 100. BeyondTrust pushed a fix to its own SaaS customers by 9 October and disclosed the issue publicly on 16 October. Anyone running the software themselves (self-hosted versions 24.3.1 through 26.2.3) needs to apply a separate patch, BT26-05-RS, by hand; organisations on even older versions have to upgrade to a supported release first before that patch will install.
What this means for your business
If you don't manage your own IT, there's a good chance your IT provider or a vendor's support team uses a remote-access tool like this one to connect into your systems when something needs fixing. This week, ask them directly whether they use BeyondTrust Remote Support (or its sibling product, Privileged Remote Access), and whether their instance is self-hosted or BeyondTrust's own SaaS. If it's self-hosted, confirm patch BT26-05-RS has actually been applied — not just scheduled — and ask whether they've checked logs back to late August for anything unusual, since this was a true zero-day and a patched system today doesn't rule out a visit weeks ago.
More broadly, this is a useful reminder that remote-support software is a high-value target precisely because one compromised appliance can be a path into every machine it's connected to. It's a reasonable, non-technical question to ask any vendor who remotely manages part of your business: how do they patch and monitor the tools that give them that access, and how quickly.