BeyondTrust Remote Support Zero-Day Exploited Since August: Patch Now

If your business or IT provider runs a self-hosted BeyondTrust Remote Support appliance, stop and check it today. A critical zero-day has been under active attack since late August, and the window to react is closing fast.

BeyondTrust has patched CVE-2026-102764, a critical authentication bypass in its Remote Support product. In plain terms, an attacker on the internet can skip the login entirely and run file operations on an unpatched appliance, no password and no clicking required. Mandiant has tied the activity to a suspected China-nexus espionage group it calls Armory Castle (previously UNC5221), which used the flaw quietly from around 29 August before the fix landed. CISA added it to its Known Exploited Vulnerabilities list on 16 October, with a patch deadline of 19 October for US federal agencies.

Why this one matters more than the average patch

Remote support software is the skeleton key of modern IT. It is the tool we and every other managed provider use to reach into client machines and fix things, which means one compromised Remote Support box is not a single breach, it is a doorway into every environment that appliance can touch. That is exactly what makes it a prize for a state-backed crew that wants quiet, long-term access rather than a quick ransom. Shadowserver counts more than 1,400 BeyondTrust instances exposed to the internet, and plenty of those sit in Australian MSP and in-house IT stacks.

What to do right now

• Patch self-hosted appliances. Apply the BT26-05-RS update. SaaS instances were fixed on 8 October, but on-premises boxes do not update themselves unless you have switched that on.
• Assume breach if you were exposed. Any internet-reachable appliance on a vulnerable version should be treated as potentially compromised until reviewed. Check for unknown web shells, log gaps and new SUID files.
• Rotate credentials. The attackers moved sideways using Administrator accounts, so reset any password or secret that appliance could reach.
• Ask your IT provider directly. If someone else manages your systems, ask them today whether they run BeyondTrust and, if so, when they patched it.

Written by Caleb Attard, All IT Services. All IT is a Sydney-based managed IT provider supporting hospitality, not-for-profit and wealth management businesses across Australia.