Affected Systems
BeyondTrust Remote Support (RS) version 26.2.3 and earlier; Privileged Remote Access (PRA) shares affected code. SaaS customers patched October 8, 2026; self-hosted installations require manual patching if auto-update disabled. Over 1,400 instances exposed online per Shadowserver.
Exploitation Status
Actively exploited in the wild since late August 2026 by China-nexus APT group Armory Castle (UNC5221 / Warp Panda). Attackers achieved root access, deployed Sawfly web shell and Bareclaw tunneler, and moved laterally using stolen credentials.
Business Impact
Critical authentication bypass allows unprivileged remote attackers to perform file operations, escalate to root, and access all credentials stored or brokered by the appliance. Compromised appliances grant attackers persistent access to downstream systems and credentials. BeyondTrust serves 20,000+ customers including 75% of Fortune 100 and government agencies. Armory Castle has history of widespread opportunistic exploitation after zero-day disclosure; similar activity expected for CVE-2026-102764.
Urgency
🔴 Immediate
Recommended Actions
- Immediately patch BeyondTrust Remote Support and Privileged Remote Access to version 26.2.4 or later, prioritizing internet-facing appliances
- Treat any internet-reachable RS/PRA appliance on vulnerable versions during August-October 2026 as potentially compromised; conduct forensic review for Sawfly web shell and Bareclaw tunneler indicators
- Review appliance logs (if available) for unauthorized file operations, SUID permission changes, and suspicious remote sessions; rotate all credentials stored or brokered by affected appliances
- Hunt for lateral movement from compromised appliances using Administrator credentials; check for unauthorized remote sessions to downstream systems
- Block or restrict internet access to BeyondTrust appliances where remote access is not required; implement network segmentation to limit lateral movement from support infrastructure