cloud.google.com Critical Zero-Day Exploit Found in BeyondTrust Remote Support
Article Content
- •CVE-2026-102764 is a critical vulnerability in BeyondTrust Remote Support with a CVSS score of 9.3.
- •The flaw allows for arbitrary file uploads and host-level control by attackers without credentials.
- •Patches were released on October 8, 2026, following the discovery of exploitation in late August.
BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring credentials or user interaction. The vulnerability affects all Remote Support versions up to 26.2.3. BeyondTrust identified the exploitation on August 29 and released a patch on October 8, 2026. Google and Mandiant have warned that the disclosure could lead to widespread exploitation, urging organizations to apply the patch immediately. The attackers used a web shell named SAWFLY to maintain access after exploiting the flaw. BeyondTrust's sensors failed to detect the initial intrusion due to false positives in its third-party detection system.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (9)
Following this threat?
Track Armory Castle, Bareclaw and CVE-2023-46805 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions of BeyondTrust are affected?
What actions should organizations take?
Is this vulnerability currently being exploited?
Continue Reading
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include… 
Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…