Skip to content
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group

First seen 16 Oct 2026, 02:36 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 16, 2026 at 13:39 UTC
  • •CVE-2026-102764 is a critical vulnerability in BeyondTrust Remote Support with a CVSS score of 9.3.
  • •The China-linked group Armory Castle exploited this zero-day from August 29, 2026, gaining root access to affected appliances.
  • •Organizations are urged to apply the patch released on October 8, 2026, to prevent further exploitation.

A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to stored credentials. BeyondTrust disclosed the vulnerability on October 15, 2026, and released a patch on October 8, 2026. The exploitation was first detected on a hosted and a self-hosted appliance, with BeyondTrust's sensors failing to alert due to false positives. Mandiant and Google have warned organizations to treat exposed appliances as potentially compromised and to apply the patch immediately to mitigate risks. The attackers utilized a PHP web shell named SAWFLY for command and control, escalating privileges and establishing persistence within the compromised systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 30d ago How this analysis works

Timeline

2026-08-29
Initial exploitation of CVE-2026-102764
Armory Castle exploited the vulnerability on a hosted and a self-hosted BeyondTrust appliance.
Cyberkendra
2026-09-28
Intrusion detected by BeyondTrust
BeyondTrust identified the intrusion after another vendor's appliances were compromised.
Csoonline

More articles in this cluster (63)

Following this threat?

Track Armory Castle, Bareclaw and CVE-2023-46805 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (33)

1 / 4

Common questions

Which versions of BeyondTrust are affected?
All Remote Support versions up to and including 26.2.3 are affected by CVE-2026-102764.
Is this vulnerability actively exploited?
Yes, exploitation in the wild has been confirmed since August 29, 2026.
What should organizations do now?
Organizations should immediately apply the patch released on October 8, 2026, and review their systems for potential compromise.