The vulnerability, tracked as CVE-2026-102764, affects Remote Support 26.2.3 or earlier and lets unprivileged remote attackers perform file operations on unpatched appliances. BeyondTrust patched the issue for all Remote Support and Privileged Remote Access SaaS customers on October 8, but self-hosted installations must be updated manually if automatic updates are not enabled.
Mandiant researchers, who spotted the initial attacks, linked the exploitation to an actor they track as Armory Castle, formerly UNC5221, which CrowdStrike calls Warp Panda. The group is known for targeting zero-day vulnerabilities in network edge appliances.
According to Mandiant, the hackers used the flaw for initial access and escalated to root privileges on compromised devices by enabling SUID permissions. They then deployed Sawfly web shell and Bareclaw tunneler malware, wiped logs to evade detection, and moved laterally through victim networks using compromised Administrator credentials to open remote sessions on downstream systems.
"After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host," Mandiant said. "This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset."
Mandiant warned that any appliance reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until reviewed. Shadowserver is tracking more than 1,400 BeyondTrust remote support instances exposed online, though it is unclear how many have been secured or are honeypots.