BeyondTrust Remote Support zero-day and the patch guidance
BeyondTrust warned customers on Thursday to patch a critical flaw in Remote Support (RS), saying it had been exploited in zero-day attacks since late August. The report identifies the issue as CVE-2026-102764 and describes it as an authentication-bypass vulnerability that allows unprivileged remote attackers to perform file operations on unpatched appliances. Source
The practical point is clear: organizations running a self-hosted deployment should check whether automatic updates are enabled and make sure the fix has been applied. BeyondTrust said it had patched Remote Support and Privileged Remote Access (PRA) SaaS customers on October 8. Self-hosted installations require manual patching when automatic updates are not enabled. Source
Which deployments the report identifies
The article says the vulnerability affects Remote Support version 26.2.3 or earlier. It separately notes BeyondTrust’s SaaS remediation: the company patched all Remote Support and PRA SaaS customers on October 8. Those are distinct deployment details, and the report does not say SaaS customers need to carry out the same manual update themselves. Source
For self-hosted Remote Support, the stated action is to apply the patch manually if automatic updates are off. The article also reports that PRA shares affected code and that BeyondTrust released a patch for it as a precaution. BeyondTrust said its internal testing had not identified a way to exploit the flaw in PRA, but recommended that self-hosted PRA customers apply the patch immediately. Source
That is the scope the report supports. It does not provide additional product-by-product instructions or explain a different workflow for applying the update. Administrators should rely on the vendor’s own patch process for the relevant installation rather than infer steps from the news report. Source
What is known about the attacks
BeyondTrust’s warning said exploitation had been underway since late August. The report attributes the observed activity to a suspected China-nexus espionage actor, identified by Mandiant and Google Threat Intelligence Group as Armory Castle, formerly tracked as UNC5221, and by CrowdStrike as Warp Panda. These are vendor and researcher attributions reported by BleepingComputer, not an independent determination in this article. Source
Mandiant researchers said the attackers used the flaw to gain initial access and raised privileges to root on compromised devices by enabling Set User ID (SUID) permissions. The report says the intruders then deployed Sawfly web-shell and Bareclaw tunneler malware, wiped logs, and moved laterally through victims’ networks using compromised administrator credentials to open remote sessions on downstream systems. Source
Mandiant also described the consequences of gaining root-level control: access to credentials stored or brokered by the appliance and the ability to modify files that persist through reboot and configuration reset. That account is a description of the activity researchers observed; it should not be read as proof that every vulnerable appliance was compromised. Source
The report warns that internet-reachable appliances running a vulnerable version during the attack period could be at risk, and relays Mandiant’s concern that broader exploitation might follow public disclosure. It does not establish that every exposed system was targeted or breached. Source
The response for administrators
Start with deployment type. For SaaS, the report says BeyondTrust applied the patch to Remote Support and PRA customers on October 8. For self-hosted systems, verify whether automatic updates are active; if not, apply the patch manually. For self-hosted PRA, BeyondTrust’s recommendation is immediate patching because PRA shares the affected code, despite the company saying its internal tests had not found a way to exploit the vulnerability there. Source
The observed post-access activity also makes it important not to treat patch status as the only question. Mandiant’s account includes root-level access, credential exposure, log wiping, and movement to other systems. The source does not provide a full incident-response checklist, so it would be wrong to present a particular forensic procedure as BeyondTrust’s prescribed response. If an organization has evidence of compromise, it should investigate through its established incident-response process and use vendor guidance for product-specific actions. Source
The report gives no basis for assuming that patching alone reverses changes made during a compromise. Its account specifically says the attackers could modify files that survive reboot and configuration reset. That makes confirmed or suspected intrusion a separate matter from installing the update; the source does not specify how to remediate a compromised appliance. Source
What the warning establishes
The core facts are limited but consequential: BeyondTrust reported zero-day exploitation beginning in late August, identified affected Remote Support versions as 26.2.3 or earlier, and described the SaaS and self-hosted patch paths. The company also released a precautionary PRA patch because the products share code, while stating its internal testing had not identified an exploitation path for PRA. Source
For customers, the immediate task is to confirm that the relevant installation received the fix—automatically or manually, depending on deployment—and treat any signs of unauthorized access as a potential incident rather than assuming an update alone settles the matter. The threat attribution and attack details come from the researchers cited in the report; BeyondTrust’s patch guidance is the actionable part for product owners. Source
Source: BleepingComputer’s report on the BeyondTrust Remote Support zero-day.