// tag
Security incidents tagged BeyondTrust. Newest first.
› BeyondTrust Remote Support (formerly Bomgar)
China-nexus actor ARMORY CASTLE (ex-UNC5221) exploited CVE-2026-102764, a critical unauthenticated file-operations flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. BeyondTrust issued BT26-05-RS; SaaS was auto-patched by Oct 9; CISA added the CVE to KEV on Oct 16. Self-hosted appliances need the patch plus forensics — patching alone does not clear existing footholds (SAWFLY / BARECLAW).
› BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) patched
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption. Added to CISA KEV on 2026-02-13.
『GTIG attributes the zero-day exploitation of CVE-2026-102764 and the subsequent deployment of SAWFLY and BARECLAW to the suspected PRC-nexus espionage actor ARMORY CASTLE (formerly tracked as UNC5221).』 ARMORY CASTLE Exploits BeyondTrust t.co/dMDDmTEMqA
🚨 CRITICAL: BEYONDTRUST REMOTE SUPPORT CVE-2026-102764 EXPLOITED AS ZERO-DAY BY PRC-NEXUS ARMORY CASTLE BeyondTrust disclosed BT26-05 (CVE-2026-102764, CVSS 9.3) on Oct 15, 2026: a critical unauthenticated file-operations flaw in Remote Support (formerly Bomgar) that can lead t.co/9PDO5pA0gA
Fresh @Mandiant and GTIG blog detailing zero day exploitation of CVE-2026-102764 in BeyondTrust Remote Support by 🇨🇳 nexus espionage actor ARMORY CASTLE (fka UNC5221). t.co/v1fGotYhM8
