BeyondTrust alerted customers on Thursday about the need to address a serious flaw in its Remote Support product that threat actors have used in zero-day attacks since late August.

Remote Support serves as the firm's enterprise tool that enables IT service desks and customer support groups to handle remote troubleshooting tasks.

Identified as CVE-2026-102764, the actively exploited authentication bypass issue allows unprivileged remote attackers to carry out file operations on vulnerable appliances and impacts versions 26.2.3 and earlier. BeyondTrust addressed the problem for all Remote Support and Privileged Remote Access SaaS users on October 8, while self-hosted setups require manual updates if automatic patching is disabled.

Although the company provided limited information on the flaw, it noted that the zero-day was used in the wild by a suspected China-linked espionage group tracked by Mandiant and Google Threat Intelligence Group researchers as Armory Castle, also known to CrowdStrike as Warp Panda.

Mandiant researchers who detected the early attacks explained that Armory Castle operators used the flaw for initial access and then gained root privileges on affected devices by setting SUID permissions.

They then installed the new Sawfly web shell and Bareclaw tunneler malware, cleared logs to avoid detection, and moved laterally across the target network with stolen Administrator credentials by launching remote sessions on other systems.

After gaining entry via the web shell, the actor moved from the web service account to root-level control of the appliance host. This provided access to all stored or brokered credentials and the capacity to alter files that persist through reboots and resets, Mandiant stated.

Any appliance reachable from the internet on a vulnerable version during the exploitation period should be considered potentially compromised until checked.

Shadowserver monitors more than 1,400 BeyondTrust remote support instances exposed online, though it offers no details on how many are protected or serve as honeypots.

Armory Castle is recognized for exploiting zero-day issues in network edge devices, such as Citrix NetScaler and Ivanti Connect Secure appliances, since at least October 2023 to infiltrate enterprise networks and install custom malware.

Volexity reported in January 2024 that the group had backdoored over 2,100 Ivanti appliances with the GiftedVisitor web shell in campaigns chaining earlier zero-days.

In prior operations, Armory Castle has launched broad and opportunistic exploitation after public disclosure of flaws it had used selectively as zero-days, aiming to compromise targets before patches arrive, Mandiant noted. Similar widespread attempts tied to CVE-2026-102764 may occur.

CVE-2026-102764 marks the latest in a series of BeyondTrust issues exploited in the wild recently. Attackers most recently leveraged another critical remote code execution flaw affecting Remote Support and Privileged Remote Access appliances to set up WebSocket channels and deploy ransomware.

The Chinese state-backed Silk Typhoon group is also thought to have used two zero-days to breach BeyondTrust systems and leverage a stolen API key to compromise 17 Remote Support SaaS instances, including one at the U.S. Treasury Department.

In that same effort, Silk Typhoon targeted the Office of Foreign Assets Control and the Committee on Foreign Investment in the United States.

BeyondTrust delivers identity security services to more than 20,000 customers globally, including government agencies and 75 percent of Fortune 100 companies.