{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:23:59.585Z",
  "tag": {
    "id": "beyondtrust",
    "label": "BeyondTrust",
    "isStack": false,
    "url": "https://pwn.watch/t/beyondtrust",
    "feed": "https://pwn.watch/t/beyondtrust/feed.xml"
  },
  "counts": {
    "incidents": 5,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "beyondtrust-remote-support-cve-2026-102764",
      "title": "BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764",
      "json": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "BeyondTrust Remote Support (formerly Bomgar)",
      "tags": [
        "beyondtrust",
        "zero-day",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-102764"
      ],
      "affectedVersions": [
        "26.2.3 and earlier; versions older than 24.3.1 must upgrade before applying BT26-05-RS"
      ],
      "fixedVersions": [
        "BT26-05-RS patch for self-hosted RS 24.3.1-26.2.3 (older versions must upgrade first); SaaS auto-patched Oct 9"
      ],
      "startedAt": "2026-08-29",
      "closedAt": null,
      "updatedAt": "2026-10-22T18:15:27+02:00",
      "summary": "China-nexus actor ARMORY CASTLE (ex-UNC5221) exploited CVE-2026-102764, a critical unauthenticated file-operations flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. BeyondTrust issued BT26-05-RS; SaaS was auto-patched by Oct 9; CISA added the CVE to KEV on Oct 16. Self-hosted appliances need the patch plus forensics — patching alone does not clear existing footholds (SAWFLY / BARECLAW).",
      "xPost": null
    },
    {
      "slug": "beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731",
      "title": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vuln",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731",
      "json": "https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)",
      "tags": [
        "beyondtrust",
        "ransomware",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-1731"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-02-13",
      "closedAt": "2026-02-13",
      "updatedAt": "2026-02-13",
      "summary": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption. Added to CISA KEV on 2026-02-13.",
      "xPost": null
    },
    {
      "slug": "beyondtrust-privileged-remote-access-pra-and-remote-sup-cve-2024-12686",
      "title": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS): Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability",
      "url": "https://pwn.watch/i/beyondtrust-privileged-remote-access-pra-and-remote-sup-cve-2024-12686",
      "json": "https://pwn.watch/i/beyondtrust-privileged-remote-access-pra-and-remote-sup-cve-2024-12686.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)",
      "tags": [
        "beyondtrust",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-12686"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-01-13",
      "closedAt": "2025-01-13",
      "updatedAt": "2025-01-13",
      "summary": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user. Added to CISA KEV on 2025-01-13.",
      "xPost": null
    },
    {
      "slug": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "title": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "json": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)",
      "tags": [
        "beyondtrust",
        "remote-support",
        "espionage",
        "data-breach",
        "cisa-kev",
        "rce",
        "nation-state"
      ],
      "cveIds": [
        "CVE-2024-12356"
      ],
      "affectedVersions": [
        "Remote Support and Privileged Remote Access 24.3.1 and earlier (BeyondTrust)"
      ],
      "fixedVersions": [
        "Patches BT24-10-ONPREM1 / BT24-10-ONPREM2 (BeyondTrust); cloud instances patched 2024-12-16"
      ],
      "startedAt": "2024-12-05",
      "closedAt": "2024-12-19",
      "updatedAt": "2024-12-30",
      "summary": "Attackers stole a BeyondTrust infrastructure API key for its Remote Support SaaS service and used it to reset local passwords and access 17 customer instances. The US Treasury, one of the customers, said a China state-sponsored actor accessed some Departmental Offices workstations and unclassified documents. During the investigation BeyondTrust found a critical command injection in Remote Support and Privileged Remote Access (CVE-2024-12356, CVSS 9.8) and patched it on 2024-12-16. Added to the CISA KEV catalog on 2024-12-19.",
      "xPost": null
    },
    {
      "slug": "okta-support-system-breach-2023",
      "title": "Okta support system breach: HAR files with session tokens stolen",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023",
      "json": "https://pwn.watch/i/okta-support-system-breach-2023.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Okta Help Center (customer support system)",
      "tags": [
        "okta",
        "beyondtrust",
        "cloudflare",
        "1password",
        "identity",
        "session-hijacking",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-09-28",
      "closedAt": "2023-11-29",
      "updatedAt": "2023-11-29",
      "summary": "An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Autumn Good",
      "handle": "autumn_good_35",
      "avatarUrl": "https://pbs.twimg.com/profile_images/753613417236172800/eRXIGCi1_bigger.jpg",
      "text": "『GTIG attributes the zero-day exploitation of CVE-2026-102764 and the subsequent deployment of SAWFLY and BARECLAW to the suspected PRC-nexus espionage actor ARMORY CASTLE (formerly tracked as UNC5221).』\n\nARMORY CASTLE Exploits BeyondTrust\nhttps://t.co/dMDDmTEMqA",
      "date": "2026-10-16T07:17:29.000Z",
      "url": "https://x.com/autumn_good_35/status/2110993518932181444",
      "media": [],
      "incident": "beyondtrust-remote-support-cve-2026-102764"
    },
    {
      "authorName": "Dark Web Intelligence",
      "handle": "DailyDarkWeb",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1507666522008915969/T-CQnTJy_bigger.jpg",
      "text": "🚨 CRITICAL: BEYONDTRUST REMOTE SUPPORT CVE-2026-102764 EXPLOITED AS ZERO-DAY BY PRC-NEXUS ARMORY CASTLE\n\nBeyondTrust disclosed BT26-05 (CVE-2026-102764, CVSS 9.3) on Oct 15, 2026: a critical unauthenticated file-operations flaw in Remote Support (formerly Bomgar) that can lead https://t.co/9PDO5pA0gA",
      "date": "2026-10-15T22:11:04.000Z",
      "url": "https://x.com/DailyDarkWeb/status/2110856005198213489",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HUtEWINWYAAGWP2.jpg"
        }
      ],
      "incident": "beyondtrust-remote-support-cve-2026-102764"
    },
    {
      "authorName": "John",
      "handle": "Big_Bad_W0lf_",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1268550997716144131/YqtdRZ2z_bigger.jpg",
      "text": "Fresh @Mandiant and GTIG blog detailing zero day exploitation of CVE-2026-102764 in BeyondTrust Remote Support by 🇨🇳 nexus espionage actor ARMORY CASTLE (fka UNC5221). \n\nhttps://t.co/v1fGotYhM8",
      "date": "2026-10-15T21:27:37.000Z",
      "url": "https://x.com/Big_Bad_W0lf_/status/2110845070975119585",
      "media": [],
      "incident": "beyondtrust-remote-support-cve-2026-102764"
    }
  ],
  "changes": [
    {
      "incident": "beyondtrust-remote-support-cve-2026-102764",
      "incidentTitle": "BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-15/16",
      "title": "Public disclosure / Mandiant blog; CISA KEV Oct 16.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764"
    },
    {
      "incident": "beyondtrust-remote-support-cve-2026-102764",
      "incidentTitle": "BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-08/09",
      "title": "BeyondTrust patches; SaaS auto-fixed.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764"
    },
    {
      "incident": "beyondtrust-remote-support-cve-2026-102764",
      "incidentTitle": "BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-08-29",
      "title": "Mandiant/GTIG: exploitation of zero-day begins (limited victims).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764"
    },
    {
      "incident": "beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731",
      "incidentTitle": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vuln",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-02-13",
      "title": "CISA added CVE-2026-1731 to the KEV catalog (due 2026-02-16).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731"
    },
    {
      "incident": "beyondtrust-privileged-remote-access-pra-and-remote-sup-cve-2024-12686",
      "incidentTitle": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS): Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-01-13",
      "title": "CISA added CVE-2024-12686 to the KEV catalog (due 2025-02-03).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/beyondtrust-privileged-remote-access-pra-and-remote-sup-cve-2024-12686"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-30",
      "title": "Treasury tells Congress of a 'major incident' attributed to a China state-sponsored APT",
      "body": null,
      "sourceUrl": "https://s3.documentcloud.org/documents/25472698/letter-from-treasury-re-december-2024-cyberattack.pdf",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-19",
      "title": "CISA added CVE-2024-12356 to the KEV catalog (federal deadline 2024-12-27)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-17",
      "title": "CVE-2024-12356 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-12356",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-16",
      "title": "BeyondTrust advisory BT24-10; cloud instances patched",
      "body": null,
      "sourceUrl": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-10",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-08",
      "title": "BeyondTrust notifies the US Treasury",
      "body": null,
      "sourceUrl": "https://s3.documentcloud.org/documents/25472698/letter-from-treasury-re-december-2024-cyberattack.pdf",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-05",
      "title": "BeyondTrust identifies a compromised Remote Support SaaS infrastructure API key",
      "body": null,
      "sourceUrl": "https://www.beyondtrust.com/remote-support-saas-service-security-investigation",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-11-29",
      "title": "Okta: the attacker downloaded the names and email addresses of all customer support system users",
      "body": null,
      "sourceUrl": "https://sec.okta.com/articles/october-security-incident-recommended-actions/",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-11-03",
      "title": "Okta root cause: the service account's password was saved in an employee's personal Google profile; 134 customers' files accessed, 5 sessions hijacked",
      "body": null,
      "sourceUrl": "https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-10-19",
      "title": "Okta notifies customers of the security incident",
      "body": null,
      "sourceUrl": "https://sec.okta.com/harfiles",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-10-18",
      "title": "Cloudflare detects attackers pivoting into its Okta instance with a token stolen from Okta",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-10-02",
      "title": "BeyondTrust detects an attacker using a session cookie from a HAR file it uploaded to Okta support and reports it to Okta",
      "body": null,
      "sourceUrl": "https://www.beyondtrust.com/blog/entry/okta-support-unit-breach",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-09-28",
      "title": "Attacker access to Okta's support system begins; a report of all support users is run at 15:06 UTC",
      "body": null,
      "sourceUrl": "https://sec.okta.com/articles/october-security-incident-recommended-actions/",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    }
  ]
}