criticallivepartial fix
day · Aug 29, 2026
BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)
› BeyondTrust Remote Support (formerly Bomgar)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
Updates on Aug 29, 2026
Mandiant/GTIG: exploitation of zero-day begins (limited victims).
## summary
China-nexus actor ARMORY CASTLE (ex-UNC5221) exploited CVE-2026-102764, a critical unauthenticated file-operations flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. BeyondTrust issued BT26-05-RS; SaaS was auto-patched by Oct 9; CISA added the CVE to KEV on Oct 16. Self-hosted appliances need the patch plus forensics — patching alone does not clear existing footholds (SAWFLY / BARECLAW).
read the full incident →
