GoKawiilBeyondTrust patches Remote Support zero-day exploited since August by China-linked hackers
BeyondTrust has issued a patch for CVE-2026-102764, an authentication bypass flaw in its Remote Support software that attackers exploited since late August to run unauthorized file operations on unpatched appliances. SaaS customers were automatically patched on October 8, while self-hosted users must update manually. Mandiant and GTIG attribute the attacks to a suspected China-nexus group called Armory Castle (also tracked as Warp Panda by CrowdStrike), which used the bug to gain root access, deploy web shells and tunneling malware, and move laterally across victim networks.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw's exploitation for root-level control means attackers could access every credential an appliance stores or brokers, making affected systems a potential pivot point into broader enterprise networks. Mandiant's warning that any internet-facing vulnerable appliance should be treated as compromised suggests organizations may need to assume breach and conduct forensic review rather than relying on patching alone. The incident also highlights ongoing espionage activity from China-linked actors targeting remote support software, a category of tools that typically holds privileged access across IT environments.
- BeyondTrust patched CVE-2026-102764, a critical authentication bypass in Remote Support exploited since August.
- Suspected China-nexus group Armory Castle (aka Warp Panda) used the flaw to gain root access, deploy malware, and move laterally.
- SaaS customers were auto-patched October 8; self-hosted installations require manual updates and possible compromise assessment.
Source: bleepingcomputer.com, 2026-10-16
Published there as: “BeyondTrust patches zero-day exploited in attacks since August”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.