BeyondTrust patches Remote Support zero-day used by Armory Castle

BeyondTrust said Armory Castle used the flaw in late August 2026 against one self-hosted Remote Support appliance. It said the problem was a failure to check the origin of internal messages, which could allow remote file operations on the appliance.

The vendor said it had pushed fixes to all Remote Support SaaS customers by 9 October 2026. It told self-hosted customers on versions 24.3.1 through 26.2.3 to apply BT26-05-RS, and said older versions had to be upgraded first.

BeyondTrust said the same group had hit the appliance on 29 August 2026, and it began investigating after another security device provider's compromise was reported on 27 September 2026. The company said the actor selected high-value targets in advance and later broadened exploitation once a flaw was public.

Mandiant said a successful compromise was followed by deployment of the SAWFLY PHP web shell and the BARECLAW SOCKS5 proxy tunnel. The researchers said the attackers tried to read stored secrets, reach other systems through Remote Support, establish persistence and remove logs.

Google Threat Intelligence Group and Mandiant said the operators used knowledge of appliance internals, including configuration templates, privileged utilities and reverse-proxy routing. They said internet-reachable appliances on a vulnerable version during the window should be treated as potentially compromised until reviewed.