Cyberattacks | Vulnerabilities

BeyondTrust Zero-Day Joins a Brutal Week of Edge Device Exploits

Suspected China-linked spies exploited a BeyondTrust Remote Support zero-day in August, weeks before a fix, to steal files. Patch now.

By Content Team

Oct 19, 2026

ON THIS PAGE

An espionage group that Mandiant tracks as Armory Castle, and researchers assess as likely China-nexus, exploited a zero-day in BeyondTrust Remote Support starting August 29, 2026. The flaw, CVE-2026-102764 (CVSS v4 9.3, Critical), stems from a messaging component that failed to validate where incoming messages came from — a serious problem in software that gives IT teams remote control over computers and servers.

Attackers moved fast. About 11 minutes after their first exploit request, a custom webshell landed. They then escalated to root, went after the appliance’s credential vault, deleted logs, and pulled internal documents off a user’s desktop. BeyondTrust knows of two affected customers so far.

BeyondTrust shipped a fix on October 8, and hosted instances are already patched. Self-hosted appliances on versions 24.3.1 through 26.2.3 need the BT26-05-RS patch; older versions must upgrade first. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16. Mandiant warns broad exploitation may follow and advises treating unpatched internet-facing appliances as potentially compromised.

The disclosure capped a rough week, with actively exploited edge flaws from Ivanti, Cisco, and Palo Alto Networks surfacing within days of each other.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?