Security · Updated 16 Oct, 11:48 am IST
BeyondTrust patches Remote Support zero-day exploited since August
Why it matters for readers: This is an example of how threat actors exploit authentication flaws to move into networks and hide their activity.
- The flaw, tracked as CVE-2026-102764, allows unprivileged remote attackers to perform file operations on affected RS 26.2.3 or earlier appliances.1
- BeyondTrust patched the vulnerability for all Remote Support and Privileged Remote Access SaaS customers on October 8; self-hosted installations require manual patching if automatic updates are not enabled.1
- Mandiant and Google TAG researchers attribute exploitation to a suspected China-nexus espionage actor tracked as Armory Castle (aka UNC5221), which CrowdStrike calls Warp Panda.1
- Mandiant reported attackers used the flaw to gain initial access, escalate to root by enabling SUID, deploy Sawfly web shell and Bareclaw tunneler, wipe logs, and move laterally using compromised Administrator credentials.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started