BeyondTrust warned customers on Thursday to patch CVE-2026-102764, a critical authentication bypass in its Remote Support (RS) appliance that unprivileged remote attackers can abuse to perform file operations.

According to BleepingComputer and The Hacker News, a China-nexus espionage group exploited the flaw in the wild starting in late August — weeks before the company even began investigating.

BeyondTrust patched SaaS customers automatically on October 8–9, but self-hosted installations running RS 26.2.3 or earlier must be updated manually to the BT26-05-RS patch.

The attacker is tracked by Mandiant and Google Threat Intelligence Group as Armory Castle (formerly UNC5221) and by CrowdStrike as Warp Panda.

The group has a record of zero-day exploitation of network edge appliances dating back to October 2023, including Citrix NetScaler CVE-2023-4966 and multiple Ivanti Connect Secure flaws.

BeyondTrust says the actor selects high-value software targets in advance and maintains a working model of its targets in an AI context used to develop exploit chains — a striking detail about how espionage tradecraft is industrializing.

Mandiant researchers, who spotted the initial intrusion on a single self-hosted appliance exploited on August 29, documented the full chain: the actor deployed the Sawfly PHP web shell and the Bareclaw SOCKS5 tunneler, copied /bin/sh to /usr/bin/dbus-authd with SUID permissions to gain root, harvested credentials via the appliance's bt-secrets CLI, pivoted to downstream systems using compromised administrator credentials and remote sessions, and wiped system, web server and application logs to evade detection.

The Hacker News reports the actor used commercial VPN exit nodes and compromised home routers for cover.

'After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host,' Mandiant said. 'This gave them access to every credential the appliance stored or brokered.'

BeyondTrust serves over 20,000 customers, including government agencies and 75% of Fortune 100 companies, making the blast radius potentially enormous.

Shadowserver tracks over 1,400 BeyondTrust remote support instances exposed online, though BleepingComputer notes it is unknown how many are patched or honeypots.

Mandiant's guidance is blunt: any appliance reachable from the internet on a vulnerable version during the exploitation window 'should be treated as potentially compromised until it has been reviewed.'

BeyondTrust's timeline, reported by The Hacker News, suggests urgency — the actor exploits zero-days selectively, then moves to broad exploitation of every unpatched instance once a flaw is public, racing in before defenders patch.

Self-hosted customers on versions older than 24.3.1 must upgrade to a newer version just to apply the fix.

The BeyondTrust breach fits a broader week of edge-device exploitation. CISA gave US federal agencies until October 17 to patch Palo Alto's CVE-2026-0322, a PAN-OS management-interface code injection flaw already used to gain root on firewalls.

Security teams are also remediating Ivanti Connect Secure zero-day CVE-2026-104935, which eSecurity Planet reports was chained by attacker UTA0576 to steal LDAP credentials and Active Directory metadata even from a fully patched appliance — where patching alone does not invalidate stolen credentials.