BeyondTrust Remote Support Zero-Day Exploited Since August by Suspected China-Linked Group

Attackers used a critical flaw in BeyondTrust Remote Support as a zero-day for about seven weeks before the vendor disclosed it on 15 October, in Rapid7's account. It's rated 9.3 on CVSS v4.0 in the CVE record BeyondTrust filed: an unauthenticated attacker can perform file operations on the appliance over the network, with no user interaction.

CISA added it to its Known Exploited Vulnerabilities catalogue on 16 October and gave US federal agencies until 19 October to fix it. The month's other actively exploited flaws are in the October KEV round-up.

What is affected

CISA's alert lists Remote Support (formerly Bomgar) 26.2.3 and earlier as affected and sets out the fix by deployment:

• Hosted (SaaS) Remote Support: already patched by BeyondTrust. No action needed.
• Self-hosted appliances on 24.3.1 or later: apply the BT26-05-RS patch.
• Self-hosted appliances older than 24.3.1: upgrade to a supported version first, then apply the patch.

Rapid7's reading of the advisory adds Privileged Remote Access. BeyondTrust hasn't found a way to exploit the flaw there, but PRA shares the affected code, so it recommends patching self-hosted PRA immediately and confirming the right patch with BeyondTrust Support.

Who was hit, and by whom

In the timeline Rapid7 took from the advisory, both known compromises date to 29 August 2026: one on a BeyondTrust-hosted instance and one on a self-hosted appliance. BeyondTrust found and contained the hosted one on 28 September and had patched every hosted customer by 9 October, six days before disclosure.

Mandiant attributes the intrusions to ARMORY CASTLE, a suspected China-nexus espionage actor previously tracked as UNC5221. In the self-hosted case, the group planted the SAWFLY web shell, gave itself root and tried to dump the appliance's credential vault. It then deleted logs and raised a compromised administrator account's permissions to open sessions into the downstream systems the appliance reaches.

What to do now

Beyond the patch, CISA's alert asks self-hosted customers to:

1. Restrict exposure. Limit external access to the services needed to support users and customers, and keep administrative interfaces on trusted networks.
2. Look for compromise with network and memory forensics on every affected appliance.

Mandiant goes further and treats any appliance that was reachable from the internet on a vulnerable version during the exploitation window as potentially compromised until it's been reviewed.

Where compromise is suspected, CISA lists five response steps:

1. Isolate the appliance.
2. Take a snapshot or forensic image, and collect web application firewall, reverse-proxy and perimeter firewall logs for the exposure window.
3. Hunt for unrecognised privileged sessions, unrecognised script files, gaps in logs or log forwarding, and unauthorised account or permission changes.
4. Rebuild from a known-good state and apply the patch.
5. Rotate every credential the appliance stored or injected, revoke all active support sessions and review new multi-factor authentication registrations on privileged accounts.