A China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a zero-day vulnerability in BeyondTrust Remote Support (formerly...
A China-nexus cyber espionage group exploited a high-severity zero-day flaw in BeyondTrust Remote Support in late August 2026.
Exploitation of Zero-Day Vulnerability by China-Linked Group
A China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a zero-day vulnerability in BeyondTrust Remote Support (formerly Bomgar) in late August 2026. The flaw, tracked as CVE-2026-102764 with a CVSS score of 9.3, is an improper origin validation issue in an internal messaging component. This allowed attackers to bypass authentication and execute file operations on unpatched systems. BeyondTrust issued a patch on October 8, 2026, addressing the vulnerability for all SaaS customers. Self-hosted installations require manual updates if automatic updates are not enabled.
Technical Details of the Vulnerability
The vulnerability, CVE-2026-102764, enables unprivileged remote attackers to perform file operations on unpatched appliances. It affects BeyondTrust Remote Support versions 26.2.3 and earlier. The company confirmed that internal testing did not identify exploitation of the Privileged Remote Access component, though the affected codebase shares components with that system. The exploit highlights the risks of unpatched systems and the need for timely security updates.
Patching and Response
BeyondTrust patched the vulnerability for all SaaS customers on October 8, 2026. Self-hosted installations must be updated manually if automatic updates are disabled. The company emphasized that internal testing did not identify exploitation of the Privileged Remote Access component, though the affected codebase shares components with that system. Organizations using BeyondTrust Remote Support are advised to verify their version and enable automatic updates if available.
Frequently Asked Questions
Q1: What was the vulnerability exploited?
The vulnerability, tracked as CVE-2026-102764, is an improper origin validation flaw in an internal messaging component of BeyondTrust Remote Support. It allows unprivileged remote attackers to bypass authentication and execute file operations on unpatched systems.