Overview
- Security firms say a critical authentication-bypass bug, tracked as CVE-2026-102764, has been actively exploited since late August to take control of BeyondTrust Remote Support appliances.
- BeyondTrust applied the patch to all Remote Support and Privileged Remote Access SaaS instances on October 8, 2026, but self-hosted appliances must be updated manually if automatic updates are not enabled.
- Mandiant and GTIG report the intruder, tracked as Armory Castle, used the bug for initial access, escalated to root by enabling SUID, deployed the Sawfly web shell and Bareclaw tunneler, and wiped logs to hide activity.
- Researchers warn any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised and undergo forensic review and credential rotation.
- The exposure is large: BeyondTrust serves about 20,000 customers including many government agencies and Fortune 100 firms, and Shadowserver tracks over 1,400 Remote Support instances reachable online, raising the risk of downstream breaches if stored credentials were stolen.