Skip to content
Critical Zero-Day Exploit in BeyondTrust Remote Support Disclosed

Critical Zero-Day Exploit in BeyondTrust Remote Support Disclosed

First seen 16 Oct 2026, 02:36 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 16, 2026 at 03:38 UTC
  • •CVE-2026-102764 is a critical vulnerability in BeyondTrust Remote Support with a CVSS score of 9.3.
  • •The flaw allows attackers to upload files and gain control without credentials or user interaction.
  • •ARMORY CASTLE, a suspected China-linked group, exploited this vulnerability starting August 29, 2026.

BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE. The flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring credentials or user interaction. Exploitation began on August 29, 2026, and BeyondTrust only released a patch on October 8, 2026, after discovering the intrusion on September 28. Google and Mandiant have warned organizations to prepare for potential widespread exploitation following the public disclosure of the vulnerability. The flaw affects all versions of BeyondTrust Remote Support up to 26.2.3, and organizations are urged to apply the patch immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2024-01-10
CVE-2023-46805 added to CISA KEV
CISA flagged the vulnerability as actively exploited in the wild and added it to the Known Exploited Vulnerabilities catalog.
CISA KEV
2024-01-10
CVE-2024-21887 added to CISA KEV
CISA flagged the vulnerability as actively exploited in the wild and added it to the Known Exploited Vulnerabilities catalog.
CISA KEV
2026-02-06
CVE-2026-1731 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-08-29
Initial exploitation of CVE-2026-102764
ARMORY CASTLE exploited the vulnerability in BeyondTrust Remote Support, gaining unauthorized access.
Cyberkendra
2026-09-28
Discovery of the intrusion
BeyondTrust discovered the exploitation of its hosted Remote Support instance during a security hunt.
Cyberkendra
2026-10-08
Patch released for CVE-2026-102764
BeyondTrust released a patch to address the critical vulnerability after confirming the exploit.
Cyberkendra
2026-10-15
Public disclosure of the vulnerability
BeyondTrust publicly disclosed CVE-2026-102764, prompting warnings from Google about potential exploitation.
Kfgo

More articles in this cluster (3)

Following this threat?

Track Armory Castle, Bareclaw and CVE-2023-46805 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (22)

1 / 4

Common questions

Which versions of BeyondTrust are affected?
All versions of BeyondTrust Remote Support up to 26.2.3 are affected by CVE-2026-102764.
What actions should organizations take?
Organizations should apply the patch released on October 8, 2026, immediately to mitigate the risk.
Is this vulnerability actively being exploited?
Yes, exploitation in the wild has been confirmed by Mandiant and Google.