Critical 9.3
CVE-2026-102764
ARMORY CASTLE Exploits BeyondTrust Remote Support Zero-Day Vulnerability CVE-2026-102764
Vendor / product: BeyondTrust Remote Support
Event date: 2026-08-29
Public PoC: Yes
First tracked by RiskWire: 2026-10-16
Named threat actors
ARMORY CASTLEUNC5221WARP PANDA
Sources & citations (11)
- Critical BeyondTrust Remote Support Vulnerability Exploited in the Wild by ARMORY CASTLE securityonline.info · 2026-10-16
- ARMORY CASTLE Exploits BeyondTrust cloud.google.com · 2026-10-16
- ARMORY CASTLE Exploits BeyondTrust Remote Support Zero-Day for Espionage mallory.ai · 2026-10-15
- BeyondTrust patches zero-day exploited in attacks since August bleepingcomputer.com · 2026-10-16
- CVE-2026-102764: BeyondTrust Zero-Day Exploited in Attacks cyberkendra.com · 2026-10-16
- China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers thehackernews.com · 2026-10-16
- Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors cybersecuritynews.com · 2026-10-16
- Hackers Exploit BeyondTrust Zero-Day to Establish Persistent Root Access and Target Credentials cyberpress.org · 2026-10-16
- Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access gbhackers.com · 2026-10-16
- BeyondTrust 0-Day Vulnerability Exploited Since August to Gain Full Admin Access in Minutes cybersecuritynews.com · 2026-10-16
- Zero-day, root и невидимый туннель. Китайские кибершпионы захватили BeyondTrust securitylab.ru · 2026-10-16
References
See CVE-2026-102764 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →