Privileged Remote Access (Product): news timeline & CVEs

BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs

China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and deployed the SAWFLY webshell.

BeyondTrust said China-nexus actor Armory Castle, formerly UNC5221 and also known as UTA0178, exploited critical Remote Support flaw CVE-2026-102764 as a zero-day beginning August 29, 2026. The 9.3-rated bug is in an internal messaging component that failed to validate message origins, letting attackers remotely control targeted systems. The group deployed its custom PHP webshell SAWFLY within 11 minutes. BeyondTrust says it serves more than 20,000 customers; earlier research found about 11,000 internet-exposed Remote Support instances. Ivanti, Cisco, and Palo Alto Networks also disclosed exploited edge-device flaws the same week.

Dark ReadingOct 16, 20:34 UTC · 7h agoExploit / PoC in the wild 16 sources CVE-2026-102764

AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support – CVE-2026-102764

BeyondTrust Remote Support CVE-2026-102764 is being exploited for unauthenticated file upload and full appliance compromise.

Canada's Cyber Centre alert AL26-025 warns of CVE-2026-102764, a critical authentication-bypass-by-spoofing flaw (CWE-290) in all versions of BeyondTrust Remote Support. A remote unauthenticated attacker can abuse weak origin checks in internal messaging to upload arbitrary files and fully compromise an appliance, with no credentials or user interaction. Open-source reporting indicates exploitation in the wild. SaaS Remote Support and Privileged Remote Access were patched on 9 October 2026; self-hosted versions 24.3.1 through 26.2.3 need the BT26-05-RS patch, and older installs must upgrade first.

Canadian Centre for Cyber Securityupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 16:34 UTC · 11h agoExploit / PoC in the wild 16 sources CVE-2026-102764

BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert

Chinese espionage group Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 for root and credential-vault access.

Mandiant and Google Threat Intelligence Group say Armory Castle, a suspected China-nexus espionage actor formerly tracked as UNC5221 and by CrowdStrike as WARP PANDA, exploited BeyondTrust Remote Support zero-day CVE-2026-102764 starting Aug. 29, 2026. The unauthenticated flaw, CVSS 9.3, allows file operations, host-level control, and access to credentials the appliance stores or brokers. The actor deployed the SAWFLY PHP web shell, a SUID root backdoor, passwordless sudo persistence, and the BARECLAW SOCKS5 tunneler, then wiped logs. BeyondTrust released a patch on Oct. 8 in advisory BT26-05; self-hosted internet-exposed systems should be reviewed, while SaaS instances were patched automatically.

CSO Onlineupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 10:24 UTC · 17h agoExploit / PoC in the wild 16 sources CVE-2026-102764

Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks

China-nexus UNC5221 exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and wiped logs.

BeyondTrust and Mandiant say a suspected China-nexus espionage cluster exploited critical zero-day CVE-2026-102764 in BeyondTrust Remote Support on 29 August 2026, hitting one hosted instance and one self-hosted appliance, then deleted logs and tooling. BeyondTrust assesses with moderate to high confidence that the actor is UNC5221, which Mandiant calls ARMORY CASTLE and CrowdStrike tracks as WARP PANDA, previously linked to Citrix NetScaler and Ivanti Connect Secure zero-days. The intruder used a custom web shell and tunneling tool, reached full admin control within minutes, and read stored secrets. SaaS instances were patched automatically; self-hosted Remote Support and Privileged Remote Access need advisory BT26-05. Technical details are being withheld while appliances are patched.

GBHackersupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 09:35 UTC · 18h agoExploit / PoC in the wild 16 sources CVE-2026-102764

BeyondTrust 0-Day Vulnerability Exploited Since August to Gain Full Admin Access in Minutes

Attackers exploited BeyondTrust Remote Support zero-day CVE-2026-102764 from August to gain full admin access.

Mandiant says suspected China-nexus espionage group ARMORY CASTLE, previously UNC5221 and also called WARP PANDA, exploited CVE-2026-102764 in BeyondTrust Remote Support starting August 29, 2026. The unauthenticated flaw, in versions through 26.2.3, allows remote file operations that can lead to full host control. Attackers installed the SAWFLY PHP web shell, escalated to root, persisted with a startup script, tunneled traffic using BARECLAW, expanded Jump Item access, collected data, and deleted logs. BeyondTrust patched on October 8, hosted tenants were updated by October 9, and a precautionary Privileged Remote Access patch was also released.

Cyber Security Newsupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 08:17 UTC · 20h agoExploit / PoC in the wild 16 sources CVE-2026-102764

BeyondTrust patches zero-day exploited in attacks since August

BeyondTrust patched CVE-2026-102764, a Remote Support authentication bypass exploited since August by China-linked Armory Castle.

BeyondTrust patched CVE-2026-102764, a critical authentication bypass in Remote Support 26.2.3 and earlier that lets unprivileged remote attackers perform file operations. Mandiant and Google Threat Intelligence Group say China-nexus Armory Castle, also UNC5221 and CrowdStrike's Warp Panda, exploited it since late August, gained root through SUID permissions, deployed the Sawfly web shell and Bareclaw tunneler, wiped logs, and moved laterally with stolen administrator credentials. SaaS customers were patched on October 8, while self-hosted systems require a manual update. Shadowserver tracks more than 1,400 exposed instances, and Mandiant warned exploitation may broaden now that the flaw is public.

BleepingComputerOct 16, 06:18 UTC · 22h agoExploit / PoC in the wildCVE-2026-102764 CVE-2023-4966 CVE-2023-46805+5 CVEs1· 1 read

Privileged Remote Access

Timeline6 articles

Related CVEsby mentions

Appears with