BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and deployed the SAWFLY webshell.
88
Organization
BeyondTrust
- Mentions · 7d0
- Mentions · 30d6
- All mentions12
- First seenSep 10, 2026
- Last mentioned14d ago
Timeline
12 articles · newest firstAL26-025 - Critical vulnerability impacting BeyondTrust Remote Support – CVE-2026-102764
BeyondTrust Remote Support CVE-2026-102764 is being exploited for unauthenticated file upload and full appliance compromise.
84
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
Chinese espionage group Armory Castle is exploiting BeyondTrust Remote Support zero-day CVE-2026-102764.
86
BeyondTrust 0-Day Vulnerability Exploited Since August to Gain Full Admin Access in Minutes
Attackers exploited BeyondTrust Remote Support zero-day CVE-2026-102764 from August to gain full admin access.
86
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 to seize support appliances.
86
Best Just-in-Time (JIT) Access Tools Compared (2026): Features & Pricing
Comparison of twelve just-in-time access tools across PAM, cloud-native, infrastructure, and governance lanes, with Microsoft Entra PIM as bundled baseline.
20
Google: AI Is Changing the Pace and Profile of Vulnerability Discovery
Google Threat Intelligence reports monthly vulnerability disclosures doubled in 2026, with exploited-in-the-wild counts nearly doubling as AI accelerates discovery.
62
AI-Found Vulnerabilities More Likely to Enable RCE, Google Says
GTIG finds 50% of likely AI-discovered vulnerabilities enable RCE versus 26% of others, as exploitation accelerates; BeyondTrust CVE-2026-1731 was exploited within four days.
58
Amazon Bedrock AgentCore Flaws Could Expose AWS Credentials
Two Amazon Bedrock AgentCore SDK flaws (CVE-2026-12530, CVE-2026-16796) enabled command execution inside AI sandboxes and exposure of attached AWS credentials; patched in 1.18.1.
58
Top 10 Best Identity Threat Detection & Response (ITDR) Tools in 2026 [Ranked & Scored]
Ranked review of ten ITDR tools scores Microsoft Defender for Identity first, with CrowdStrike Falcon and Silverfort completing the podium for identity threat detection.
15
12 Best Endpoint Privilege Management (EPM) Tools Compared (2026): Features & Pricing
A 2026 buyer's guide compares 12 endpoint privilege management tools, ranking CyberArk and BeyondTrust as enterprise leaders.
12
Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways
Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.
72
Related CVEs
by mentions- CVE-2026-10276419%9.3Message-origin spoofing enables file ops on BeyondTrust Remote Support
- CVE-2026-173193%9.9Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA
- CVE-2024-21887100%9.1Command Injection RCE in Ivanti Connect Secure and Policy Secure
- CVE-2025-0282100%9.0Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways
- CVE-2023-46805100%8.2Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
- CVE-2025-535212%9.3Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE
- CVE-2023-4966100%7.5Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway
- CVE-2026-16796<1%8.4Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote…
- CVE-2026-12530<1%8.4Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK versions >= 1.1.3 and < 1.6.1 might allow a…
Appears with
- BeyondTrustvendor · 6
- BeyondTrust Remote Supportproduct · 5
- Mandiantorganization · 5
- Armory Castlethreat actor · 4
- Sawflymalware · 4
- UNC5221threat actor · 4
- Privileged Remote Accessproduct · 3
- Ivantivendor · 3
- Microsoftorganization · 3
- Bareclawmalware · 3
- CrowdStrikeorganization · 2
- Citrixvendor · 2
- CyberArkorganization · 2
- Google Threat Intelligence Grouporganization · 2
- Warp Pandathreat actor · 2
- Delineaorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.