# BeyondTrust security incidents · pwn.watch

> Security incidents tagged BeyondTrust (vendor, product, platform or attack type).

Page: https://pwn.watch/t/beyondtrust · generated 2026-10-22T18:38:01.102Z

## Status (as of 2026-10-22)
- Incidents: 5 (1 live, 1 live and not fully patched, 4 patched)
- Days without a BeyondTrust security incident: 0 (1 still unpatched, so the counter stays at 0)
- Newest incident started: 2026-08-29

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/beyondtrust.json
- RSS (one item per incident, bumped on each update): https://pwn.watch/t/beyondtrust/feed.xml
- This file: https://pwn.watch/t/beyondtrust/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)](https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764) ([json](https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764.json)): critical, live, partial, started 2026-08-29, CVE-2026-102764
- [BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vuln](https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731) ([json](https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731.json)): high, closed, patched, started 2026-02-13, CVE-2026-1731
- [BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS): Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability](https://pwn.watch/i/beyondtrust-privileged-remote-access-pra-and-remote-sup-cve-2024-12686) ([json](https://pwn.watch/i/beyondtrust-privileged-remote-access-pra-and-remote-sup-cve-2024-12686.json)): medium, closed, patched, started 2025-01-13, CVE-2024-12686
- [BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)](https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356) ([json](https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356.json)): critical, closed, patched, started 2024-12-05, CVE-2024-12356
- [Okta support system breach: HAR files with session tokens stolen](https://pwn.watch/i/okta-support-system-breach-2023) ([json](https://pwn.watch/i/okta-support-system-breach-2023.json)): high, closed, no-fix-needed, started 2023-09-28