Story · 13 sources · 16 articlesfirst Oct 15, 14:00 UTCupdated Oct 16, 20:34 UTC (7h ago)

China-linked group exploited BeyondTrust Remote Support zero-day

criticalExploit / PoCexploited in the wildimportance 88CVE-2026-102764 CVE-2026-1731 CVE-2023-46805 CVE-2024-21887 CVE-2025-0282 CVE-2023-4966 CVE-2026-22769

What's new: These reports add CISA’s October 16, 2026 KEV listing, which calls CVE-2026-102764 an authentication bypass in Remote Support (formerly Bomgar) and says versions older than 24.3.1 must be upgraded before BT26-05-RS, plus the SAWFLY and BARECLAW filenames mangoapi.php and ingredi_ws.

Merged summary · grok-4.7-build · rewritten as coverage arrives

Suspected China-nexus Armory Castle exploited BeyondTrust Remote Support CVE-2026-102764 from August 29, 2026, and CISA added it to the KEV catalog.

Mandiant, Google Threat Intelligence Group, and BeyondTrust say suspected China-nexus espionage group Armory Castle—formerly UNC5221, CrowdStrike’s Warp Panda, and also UTA0178 according to Dark Reading—exploited BeyondTrust Remote Support zero-day CVE-2026-102764 (CVSS 9.3) starting August 29, 2026, before an October 8 patch and October 15 disclosure. Several outlets describe improper origin validation in internal messaging that allows unauthenticated remote file operations through version 26.2.3, while CISA describes an authentication bypass in Remote Support (formerly Bomgar) 26.2.3 and earlier. BeyondTrust attributes the activity to UNC5221 with moderate to high confidence; Infosecurity Magazine says the actor has been active since October 2023, The Record says the August activity followed a September 27 tip, and CyberScoop says the first known intrusion was contained on September 28. Victim scope differs: The Hacker News cites one self-hosted appliance, GBHackers and CSO Online cite one hosted instance and one self-hosted appliance, and CyberScoop says only a small number of victims are confirmed though pre-disclosure compromises may be broader. Attackers then deployed the SAWFLY PHP webshell mangoapi.php—Dark Reading says within 11 minutes—a SUID root shell, sudoers or startup persistence, harvested secrets with bt-secrets, expanded Jump access, installed the BARECLAW SOCKS5 tunneler ingredi_ws, and deleted logs; The Record says the malware survives reboots and resets and that every stored credential was stolen. Patch timing is disputed—CyberScoop says cloud versions were updated on October 8 with the self-hosted patch, while other outlets say SaaS was updated by October 9 or automatically—self-hosted releases 24.3.1 through 26.2.3 need BT26-05-RS, older versions must upgrade first, Privileged Remote Access received a precautionary patch, CISA added the flaw to the KEV catalog on October 16, 2026, and Mandiant and Google urge access limits, credential rotation, forensics, and clean rebuilds rather than reboots alone.

CVE-2026-102764 (CVSS 9.3) affects BeyondTrust Remote Support through 26.2.3; most reports describe improper origin validation that allows unauthenticated remote file operations, while CISA calls it an authentication bypass in Remote…
Suspected China-nexus Armory Castle—formerly UNC5221, CrowdStrike’s Warp Panda, and also UTA0178 per Dark Reading—exploited it as a zero-day from August 29, 2026; BeyondTrust attributes UNC5221 with moderate to high confidence, and…

VendorsBeyondTrust Ivanti Cisco Palo Alto Networks Google CrowdStrike Citrix Mandiant Dell

ProductsBeyondTrust Remote Support Privileged Remote Access Bomgar Citrix NetScaler Ivanti Connect Secure Dell RecoverPoint for Virtual Machines

Threat actorsArmory Castle UNC5221 UTA0178 WARP PANDA ARMORY CASTLE Warp Panda

Coverage timelineoldest first · each row is one article

Oct 15, 14:00 UTC · 1d ago
Google Threat Intelligence· 82
ARMORY CASTLE Exploits BeyondTrust
Suspected China-nexus group ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 to steal appliance credentials.
Oct 16, 04:59 UTC · 23h ago
GBHackers· 84
Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access
China-linked ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 for root access before disclosure.
Oct 16, 06:55 UTC · 21h ago
The Hacker News· 86
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

Vulnerabilities in this storyAll →

CVE-2024-218879.1100%
Command Injection RCE in Ivanti Connect Secure and Policy Secure
published Jan 12, 2024· Ivanti Connect Secure (ICS, formerly Pulse Connect Secure) KEV ransomware PoC

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2024-21887 +1 related CVE CVE-2023-46805	Command Injection RCE in Ivanti Connect Secure and Policy Secure Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure appliances contain a command injection flaw (CWE-77) in their web components, triggered when an authenticated administrator sends crafted requests to the appliance. The bug can be chained with the separate authentication bypass CVE-2023-46805, allowing an unauthenticated attacker to achieve the same result. Successful exploitation lets an attacker execute arbitrary commands and code on the appliance, providing a foothold into the networks behind the VPN or network access control gateway. Any organization running these appliances, typically enterprises and government agencies often deployed directly on the internet perimeter, is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-10 with known ransomware use and EPSS assigns a 100% probability of exploitation within 30 days, although no public proof-of-concept is available. Do: Apply Ivanti's mitigations or patched builds immediately per vendor instructions, addressing the chained authentication bypass CVE-2023-46805 at the same time, and discontinue or restrict use of any appliance for which mitigations are unavailable, especially if it is internet-facing. Because exploitation with ransomware use is known, assume compromise is possible: review appliance web logs for suspicious requests and run Ivanti's integrity-checking guidance to verify appliance images before and after remediation. Where feasible, restrict direct internet exposure of the appliance web interface and monitor for further vendor advisories.	9.1 group max	100%	KEV ransomware PoC	Ivanti Connect Secure (ICS, formerly Pulse Connect Secure) Ivanti Policy Secure	largetens of thousands of appliances (roughly 20,000-30,000 internet-exposed ICS gateways at disclosure; total deployed base likely higher)	Jan 12, 2024 KEV Jan 10, 2024
CVE-2023-4966	Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway Citrix NetScaler ADC and NetScaler Gateway appliances contain a buffer overflow (CWE-119) that leaks sensitive information from device memory when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. A remote attacker who can reach such a configuration can trigger the overflow and read memory contents, harvesting sensitive data such as session tokens (a technique that enables session hijacking which can bypass multi-factor authentication). Any organization running an affected NetScaler ADC or Gateway appliance in these configurations is exposed, with appliances deployed as VPN or access gateways being the primary concern. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2023-10-18 with known ransomware use and a 100% EPSS exploitation probability, although no public proof-of-concept is known at this time. Because tokens stolen from memory can remain valid even after patching, responders must terminate all active and persistent sessions as part of remediation. Do: Upgrade affected appliances to the patched builds cited in Citrix's advisory, then immediately kill all active and persistent ICA/AAA sessions per the vendor instructions, since patching alone does not invalidate session tokens attackers may have already stolen. If patching is not immediately possible, discontinue use of the affected Gateway/AAA configurations as CISA directs. Given known ransomware abuse, also hunt for signs of exploitation such as logins from unexpected sources, anomalous session reuse, or suspicious mailbox changes, and reset credentials for potentially exposed accounts.	7.5	100%	KEV ransomware
CVE-2025-0282	Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways CVE-2025-0282 is a stack-based buffer overflow (CWE-121) in Ivanti Connect Secure, Policy Secure, and ZTA Gateways, reachable by unauthenticated network input. An attacker can trigger it remotely by sending crafted, unauthenticated traffic to a vulnerable gateway, overwriting stack memory and gaining code execution under the appliance's context. Successful exploitation yields unauthenticated remote code execution on the device, giving the attacker control of the VPN/secure-access gateway and a foothold into the protected network. Organizations running any of the affected Ivanti secure-access products are exposed; the source data specifies no version ranges, so defenders should consult Ivanti's advisory for exact affected and fixed releases. The flaw is being actively exploited: it was added to CISA KEV on 2025-01-08 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days (100th percentile), despite no public PoC being known. Do: Apply the patched releases identified in Ivanti's advisory and follow CISA's required action: hunt for signs of compromise, remediate if indicators are found, and apply updates before returning any device to service. Because exploitation is active and ransomware use is known, treat any appliance that was internet-reachable before patching as potentially compromised (check integrity, rotate credentials). Exact fixed versions were not included in the source data, so verify the correct update path for your branch (including older Connect Secure/Policy Secure releases) against Ivanti's bulletin.	9.0	100%	KEV ransomware
CVE-2026-102764	Message-origin spoofing enables file ops on BeyondTrust Remote Support CVE-2026-102764 is a critical (CVSS 4.0 9.3) authentication-bypass-by-spoofing flaw (CWE-290) in internal components of BeyondTrust Remote Support. Those components do not adequately check the origin of messages they receive, so a remote attacker can, under the right conditions, send spoofed messages over the network with no privileges and no user interaction. Successful exploitation can allow file operations on the appliance, with high impact to confidentiality, integrity, and availability of the vulnerable system and no stated impact on other systems. The provided data identifies BeyondTrust Remote Support but does not name affected version ranges. No public proof of concept is known and the CVE is not listed in CISA KEV; a related headline refers to “ARMORY CASTLE” exploiting BeyondTrust, but that report is not confirmed by the structured advisory data. Do: Keep BeyondTrust Remote Support appliances off untrusted networks and allow management and support traffic only from trusted sources. Apply the vendor patch or hotfix for this issue as soon as BeyondTrust publishes it for your build, and review appliance logs for unexpected file operations or messages from untrusted origins. No fixed version is named in the provided data, so confirm the corrected release directly with BeyondTrust.	9.3	<1%	KEV PoC	BeyondTrust Remote Support
CVE-2026-1731	Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical (CVSS 4.0: 9.9) pre-authentication operating system command injection vulnerability (CWE-78). By sending specially crafted requests to the appliance, an unauthenticated remote attacker can execute operating system commands in the context of the site user, gaining code execution without credentials or user interaction. Any organization running RS or PRA appliances that are reachable from the internet, which is their typical deployment mode for remote support and privileged access, is affected. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-13 with known ransomware use, carries an EPSS of 89.5% (100th percentile), has a public proof-of-concept, and press coverage links the newly patched BeyondTrust RCE to fast-moving ransomware activity (Storm-1175). BeyondTrust has released fixes, so unpatched, internet-exposed instances should be treated as high-priority compromise targets. Do: Upgrade all internet-exposed Remote Support and Privileged Remote Access appliances to the fixed releases in BeyondTrust's security advisory immediately, per the CISA KEV required action (apply vendor mitigations or discontinue use if mitigation is unavailable). Until patched, restrict network access to the appliance and review appliance/web logs for suspicious unauthenticated requests, given known ransomware exploitation and the availability of a public proof-of-concept.	9.9	92%	KEV ransomware
CVE-2026-22769	Hard-coded credentials in Dell RecoverPoint for Virtual Machines allow root OS access Dell RecoverPoint for Virtual Machines (RP4VMs) versions prior to 6.0.3.1 HF1 contain hard-coded credentials (CWE-798) for the appliance's underlying operating system. An unauthenticated remote attacker who knows the hard-coded credential can authenticate over the network with no user interaction and gain root-level access and persistence on the underlying OS — beyond just the RecoverPoint application — which is why the flaw scores a maximum CVSS of 10.0 with scope changed. Any organization running an affected RP4VMs release is exposed, with risk highest where appliance management interfaces are reachable from broader networks. The vulnerability is confirmed exploited in the wild: it was added to CISA's KEV catalog on 2026-02-18, and reporting indicates China-linked actors exploited it as a zero-day since at least 2024, prompting an emergency federal patch directive; related coverage ties the activity to the China-linked VerdantBamboo actor deploying BRICKSTORM-family backdoors on appliances. Do: Upgrade all RP4VMs appliances to 6.0.3.1 HF1 or apply Dell's published remediations immediately — federal agencies must patch per BOD 22-01 by the KEV deadline (reported as 'by Saturday'). Because exploitation has occurred since at least 2024, treat deployed appliances as potentially compromised: review the underlying OS for unexpected accounts, modified services, and root persistence, and restrict the appliance's management/replication network reachability until patched.	10.0	14%	KEV	Dell RecoverPoint for Virtual Machines (RP4VMs)

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2024-21887

+1 related CVE

CVE-2023-46805

Command Injection RCE in Ivanti Connect Secure and Policy Secure

Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure appliances contain a command injection flaw (CWE-77) in their web components, triggered when an authenticated administrator sends crafted requests to the appliance. The bug can be chained with the separate authentication bypass CVE-2023-46805, allowing an unauthenticated attacker to achieve the same result. Successful exploitation lets an attacker execute arbitrary commands and code on the appliance, providing a foothold into the networks behind the VPN or network access control gateway. Any organization running these appliances, typically enterprises and government agencies often deployed directly on the internet perimeter, is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-10 with known ransomware use and EPSS assigns a 100% probability of exploitation within 30 days, although no public proof-of-concept is available.

Do: Apply Ivanti's mitigations or patched builds immediately per vendor instructions, addressing the chained authentication bypass CVE-2023-46805 at the same time, and discontinue or restrict use of any appliance for which mitigations are unavailable, especially if it is internet-facing. Because exploitation with ransomware use is known, assume compromise is possible: review appliance web logs for suspicious requests and run Ivanti's integrity-checking guidance to verify appliance images before and after remediation. Where feasible, restrict direct internet exposure of the appliance web interface and monitor for further vendor advisories.

9.1

group max

100%

KEV ransomware PoC

Ivanti Connect Secure (ICS, formerly Pulse Connect Secure)
Ivanti Policy Secure

largetens of thousands of appliances (roughly 20,000-30,000 internet-exposed ICS gateways at disclosure; total deployed base likely higher)

Jan 12, 2024

KEV Jan 10, 2024

CVE-2023-4966

Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway

Citrix NetScaler ADC and NetScaler Gateway appliances contain a buffer overflow (CWE-119) that leaks sensitive information from device memory when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. A remote attacker who can reach such a configuration can trigger the overflow and read memory contents, harvesting sensitive data such as session tokens (a technique that enables session hijacking which can bypass multi-factor authentication). Any organization running an affected NetScaler ADC or Gateway appliance in these configurations is exposed, with appliances deployed as VPN or access gateways being the primary concern. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2023-10-18 with known ransomware use and a 100% EPSS exploitation probability, although no public proof-of-concept is known at this time. Because tokens stolen from memory can remain valid even after patching, responders must terminate all active and persistent sessions as part of remediation.

Do: Upgrade affected appliances to the patched builds cited in Citrix's advisory, then immediately kill all active and persistent ICA/AAA sessions per the vendor instructions, since patching alone does not invalidate session tokens attackers may have already stolen. If patching is not immediately possible, discontinue use of the affected Gateway/AAA configurations as CISA directs. Given known ransomware abuse, also hunt for signs of exploitation such as logins from unexpected sources, anomalous session reuse, or suspicious mailbox changes, and reset credentials for potentially exposed accounts.

7.5

100%

KEV ransomware

CVE-2025-0282

Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways

CVE-2025-0282 is a stack-based buffer overflow (CWE-121) in Ivanti Connect Secure, Policy Secure, and ZTA Gateways, reachable by unauthenticated network input. An attacker can trigger it remotely by sending crafted, unauthenticated traffic to a vulnerable gateway, overwriting stack memory and gaining code execution under the appliance's context. Successful exploitation yields unauthenticated remote code execution on the device, giving the attacker control of the VPN/secure-access gateway and a foothold into the protected network. Organizations running any of the affected Ivanti secure-access products are exposed; the source data specifies no version ranges, so defenders should consult Ivanti's advisory for exact affected and fixed releases. The flaw is being actively exploited: it was added to CISA KEV on 2025-01-08 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days (100th percentile), despite no public PoC being known.

Do: Apply the patched releases identified in Ivanti's advisory and follow CISA's required action: hunt for signs of compromise, remediate if indicators are found, and apply updates before returning any device to service. Because exploitation is active and ransomware use is known, treat any appliance that was internet-reachable before patching as potentially compromised (check integrity, rotate credentials). Exact fixed versions were not included in the source data, so verify the correct update path for your branch (including older Connect Secure/Policy Secure releases) against Ivanti's bulletin.

9.0

100%

KEV ransomware

CVE-2026-102764

Message-origin spoofing enables file ops on BeyondTrust Remote Support

CVE-2026-102764 is a critical (CVSS 4.0 9.3) authentication-bypass-by-spoofing flaw (CWE-290) in internal components of BeyondTrust Remote Support. Those components do not adequately check the origin of messages they receive, so a remote attacker can, under the right conditions, send spoofed messages over the network with no privileges and no user interaction. Successful exploitation can allow file operations on the appliance, with high impact to confidentiality, integrity, and availability of the vulnerable system and no stated impact on other systems. The provided data identifies BeyondTrust Remote Support but does not name affected version ranges. No public proof of concept is known and the CVE is not listed in CISA KEV; a related headline refers to “ARMORY CASTLE” exploiting BeyondTrust, but that report is not confirmed by the structured advisory data.

Do: Keep BeyondTrust Remote Support appliances off untrusted networks and allow management and support traffic only from trusted sources. Apply the vendor patch or hotfix for this issue as soon as BeyondTrust publishes it for your build, and review appliance logs for unexpected file operations or messages from untrusted origins. No fixed version is named in the provided data, so confirm the corrected release directly with BeyondTrust.

9.3

<1%

KEV PoC

BeyondTrust Remote Support

CVE-2026-1731

Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical (CVSS 4.0: 9.9) pre-authentication operating system command injection vulnerability (CWE-78). By sending specially crafted requests to the appliance, an unauthenticated remote attacker can execute operating system commands in the context of the site user, gaining code execution without credentials or user interaction. Any organization running RS or PRA appliances that are reachable from the internet, which is their typical deployment mode for remote support and privileged access, is affected. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-13 with known ransomware use, carries an EPSS of 89.5% (100th percentile), has a public proof-of-concept, and press coverage links the newly patched BeyondTrust RCE to fast-moving ransomware activity (Storm-1175). BeyondTrust has released fixes, so unpatched, internet-exposed instances should be treated as high-priority compromise targets.

Do: Upgrade all internet-exposed Remote Support and Privileged Remote Access appliances to the fixed releases in BeyondTrust's security advisory immediately, per the CISA KEV required action (apply vendor mitigations or discontinue use if mitigation is unavailable). Until patched, restrict network access to the appliance and review appliance/web logs for suspicious unauthenticated requests, given known ransomware exploitation and the availability of a public proof-of-concept.

9.9

92%

KEV ransomware

CVE-2026-22769

Hard-coded credentials in Dell RecoverPoint for Virtual Machines allow root OS access

Dell RecoverPoint for Virtual Machines (RP4VMs) versions prior to 6.0.3.1 HF1 contain hard-coded credentials (CWE-798) for the appliance's underlying operating system. An unauthenticated remote attacker who knows the hard-coded credential can authenticate over the network with no user interaction and gain root-level access and persistence on the underlying OS — beyond just the RecoverPoint application — which is why the flaw scores a maximum CVSS of 10.0 with scope changed. Any organization running an affected RP4VMs release is exposed, with risk highest where appliance management interfaces are reachable from broader networks. The vulnerability is confirmed exploited in the wild: it was added to CISA's KEV catalog on 2026-02-18, and reporting indicates China-linked actors exploited it as a zero-day since at least 2024, prompting an emergency federal patch directive; related coverage ties the activity to the China-linked VerdantBamboo actor deploying BRICKSTORM-family backdoors on appliances.

Do: Upgrade all RP4VMs appliances to 6.0.3.1 HF1 or apply Dell's published remediations immediately — federal agencies must patch per BOD 22-01 by the KEV deadline (reported as 'by Saturday'). Because exploitation has occurred since at least 2024, treat deployed appliances as potentially compromised: review the underlying OS for unexpected accounts, modified services, and root persistence, and restrict the appliance's management/replication network reachability until patched.

10.0

14%

KEV

Dell RecoverPoint for Virtual Machines (RP4VMs)