BeyondTrust Remote Support Faces Fresh Probes for Critical Flaw
Probes target BeyondTrust Remote Support versions 26.2.3 and earlier; CISA added to KEV with active exploitation.
2
Stories per day · 30 days
7 RSS
Relatedcve-2026-10276418remote-support16zero-day15armory-castle12china9unc52219webshell6authentication-bypass5espionage5kev5web-shell4cisa3canada2edge-device2exploitation2fortinet2sawfly2actively-exploited1
29 stories, newest first · one card per story
Stories tagged #beyondtrust
BeyondTrust Remote Support flaw yields unauthenticated RCE
Rapid7’s Metasploit module writes a PHP file via a forged local router ID and runs it as the site user.
2
NIST, CISA and NSA publish AI agent incident-response practices
A BeyondTrust architect says responders should start from the agent identity record, not from classifying intent.
1
BeyondTrust Remote Support auth bypass CVE-2026-102764 exploited before disclosure
Unauthenticated attackers can perform file operations on Remote Support 26.2.3 and earlier; CISA set a October 19 KEV due date.
8
Weekly recap: BeyondTrust zero-day, ConnectWise access, Ledger thefts
Armory Castle used CVE-2026-102764 for file operations, then planted SAWFLY and BARECLAW on a few victims.
6
U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Fortinet and BeyondTrust flaws to KEV, with a federal fix deadline of October 19.
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and deployed the SAWFLY webshell.
2
Prolific Chinese espionage group exploits BeyondTrust zero-day
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 starting in late August.
2
AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support – CVE-2026-102764
BeyondTrust Remote Support CVE-2026-102764 is being exploited for unauthenticated file upload and full appliance compromise.
6
CVE-2026-102764: BeyondTrust Zero-Day Exploited
SOCRadar reports BeyondTrust zero-day CVE-2026-102764 is being exploited, but the page lacks technical detail.
6
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
Chinese espionage group Armory Castle is exploiting BeyondTrust Remote Support zero-day CVE-2026-102764.
5
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited Fortinet and BeyondTrust flaws to the Known Exploited Vulnerabilities catalog.
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
CISA says attackers are exploiting critical BeyondTrust Remote Support flaw CVE-2026-102764, now on KEV.
2
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
China-linked Armory Castle exploited BeyondTrust Remote Support CVE-2026-102764 as a zero-day since August.
8
BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert
Chinese espionage group Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 for root and credential-vault access.
6
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
China-nexus UNC5221 exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and wiped logs.
3
BeyondTrust 0-Day Vulnerability Exploited Since August to Gain Full Admin Access in Minutes
Attackers exploited BeyondTrust Remote Support zero-day CVE-2026-102764 from August to gain full admin access.
7
Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors
China-linked ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 for root access and persistent backdoors.
9
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust patched CVE-2026-102764, a Remote Support authentication bypass exploited since August by China-linked Armory Castle.
8
Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access
China-linked ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 for root access before disclosure.
8
CISA adds BeyondTrust Remote Support CVE-2026-102764 to KEV
Weak message-origin checks can allow file operations on the appliance; the federal due date is October 19, 2026.
1
ARMORY CASTLE Exploits BeyondTrust
Suspected China-nexus group ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 to steal appliance credentials.
16
11 Best PAM Solutions Compared (2026): Features & Pricing
A 2026 comparison ranks CyberArk the deepest PAM suite, with Delinea and Teleport leading usability and infrastructure access.
5
The vulnerabilities AI finds are the ones attackers want
GTIG says AI-found flaws skew toward remote code execution, and attackers hit BeyondTrust CVE-2026-1731 within four days.
6