BeyondTrust patches critical zero-day exploited by Armory Castle

BeyondTrust has disclosed a critical zero-day vulnerability, identified as CVE-2026-102764, in its Remote Support (RS) product. The flaw, which carries a CVSS score of 9.3, involves improper origin validation in an internal messaging component, allowing unauthenticated remote attackers to perform unauthorized file operations on vulnerable appliances.

Security researchers from Mandiant and the Google Threat Intelligence Group (GTIG) have attributed the exploitation of this flaw to a suspected China-nexus espionage group known as Armory Castle (also tracked as UNC5221 or Warp Panda). The group began exploiting the vulnerability as early as August 29, 2026, nearly seven weeks before the public disclosure on October 15.

During the attacks, threat actors used the flaw to gain initial access, escalate privileges to root, and deploy malware such as the Sawfly web shell. Once a foothold was established, the attackers harvested credentials and moved laterally through victim networks by opening remote sessions on downstream systems.

BeyondTrust has released patches for all Remote Support and Privileged Remote Access SaaS customers. For self-hosted installations, customers must manually apply the BT26-05 patch or upgrade to supported versions to mitigate the risk.