Skip to content
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor

First seen 20 Oct 2026, 15:52 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 16:14 UTC
  • •CVE-2026-102764 is a critical vulnerability in BeyondTrust Remote Support with a CVSS score of 9.3.
  • •The vulnerability is actively exploited by the ARMORY CASTLE group, linked to China.
  • •A patch was released on October 8, 2026, but exploitation has been ongoing since late August.

A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host systems. BeyondTrust issued a patch on October 8, 2026, but the vulnerability was publicly disclosed only on October 15, 2026. The German Federal Office for Information Security (BSI) has issued a warning, raising the CVSS score to 9.8 due to the severity of the. The exploitation has been ongoing since late August 2026, with attackers using tools such as the SAWFLY web shell and BARECLAW backdoor for persistent access.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-08-31
Active exploitation began
The ARMORY CASTLE group reportedly started exploiting CVE-2026-102764 as a zero-day vulnerability.
B2B-Cyber-Security.De
2026-09-08
CVE-2026-44756 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-08
Patch released
BeyondTrust released a patch for the critical vulnerability CVE-2026-102764 to mitigate the risk.
B2B-Cyber-Security.De
2026-10-15
Vulnerability disclosed
BeyondTrust publicly disclosed the vulnerability CVE-2026-102764 in an advisory.
B2B-Cyber-Security.De
2026-10-15
CVE-2026-102764 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-16
CISA KEV listing
CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog due to confirmed exploitation.
B2B-Cyber-Security.De

More articles in this cluster (2)

Following this threat?

Track Armory Castle, Bareclaw and Ricardo in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 4

Common questions

What systems are affected?
All supported versions of BeyondTrust Remote Support up to 26.2.3 are affected.
How urgent is this vulnerability?
This vulnerability is critical and actively exploited, requiring immediate attention and patching.
What should organizations do?
Organizations should apply the patch released on October 8, 2026, to mitigate the risk.