---
title: BeyondTrust Zero-Day Joins a Brutal Week of Edge Device Exploits
description: Suspected China-linked spies exploited a BeyondTrust Remote Support zero-day in August, weeks before a fix, to steal files. Patch now.
canonical_url: https://codekeeper.co/ticker/beyondtrust-zero-day-flaw-exploited
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks) | [Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

# BeyondTrust Zero-Day Joins a Brutal Week of Edge Device Exploits

Suspected China-linked spies exploited a BeyondTrust Remote Support zero-day in August, weeks before a fix, to steal files. Patch now.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 19, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbeyondtrust-zero-day-flaw-exploited%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbeyondtrust-zero-day-flaw-exploited%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbeyondtrust-zero-day-flaw-exploited%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbeyondtrust-zero-day-flaw-exploited%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbeyondtrust-zero-day-flaw-exploited%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbeyondtrust-zero-day-flaw-exploited%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

An espionage group that Mandiant tracks as Armory Castle, and researchers assess as likely China-nexus, exploited a zero-day in BeyondTrust Remote Support starting August 29, 2026. The flaw, CVE-2026-102764 (CVSS v4 9.3, Critical), stems from a messaging component that failed to validate where incoming messages came from — a serious problem in software that gives IT teams remote control over computers and servers. Attackers moved fast. About 11 minutes after their first exploit request, a custom webshell landed. They then escalated to root, went after the appliance’s credential vault, deleted logs, and pulled internal documents off a user’s desktop. BeyondTrust knows of two affected customers so far. BeyondTrust shipped a fix on October 8, and hosted instances are already patched. Self-hosted appliances on versions 24.3.1 through 26.2.3 need the BT26-05-RS patch; older versions must upgrade first. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16. Mandiant warns broad exploitation may follow and advises treating unpatched internet-facing appliances as potentially compromised. The disclosure capped a rough week, with actively exploited edge flaws from Ivanti, Cisco, and Palo Alto Networks surfacing within days of each other. Source: [Dark Reading](https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbeyondtrust-zero-day-flaw-exploited%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbeyondtrust-zero-day-flaw-exploited%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbeyondtrust-zero-day-flaw-exploited%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbeyondtrust-zero-day-flaw-exploited%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbeyondtrust-zero-day-flaw-exploited%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbeyondtrust-zero-day-flaw-exploited%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks TanStack Attack Exposed 170 Private CrowdSec Repositories Sep 21, 2026](https://codekeeper.co/ticker/tanstack-npm-supply-chain-attack)

[North Korea's Lazarus Group Exploits Windows Kernel Zero-Day to Deploy Upgraded Rootkit Aug 12, 2026](https://codekeeper.co/ticker/north-korea-lazarus-zero-day-exploit)

[New 'Bucket Hijacking' Attack Can Silently Reroute Your Cloud Data to Hackers Aug 12, 2026](https://codekeeper.co/ticker/cloud-bucket-hijacking-attack-prevention)

[Cyber Attack Forces Great Marlow School to Partially Close Aug 12, 2026](https://codekeeper.co/ticker/malware-attack-hits-great-marlow-school-it-systems)