AX·NEWS
Sign in

Vulnerability

CVE-2026-102764 — BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

critical 9.3 Exploited in the wild 4 stories · 4 outlets

Official record (cve.org)NVDCVE watch

Impacted if

  • BeyondTrust Remote Support ≤ 26.2.3

Authentication bypass · over the network · no login

The vulnerability exists within internal components of BeyondTrust’s Remote Support product.

CISA Known Exploited Vulnerabilities

Added on 2026-10-16, federal remediation due 2026-10-19. BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

First seen by AX-NEWS · latest story . Severity: NVD, or the CVE record while the NVD has not scored it. This product uses data from the NVD API but is not endorsed or certified by the NVD.

Coverage

  1. Prolific Chinese espionage group exploits BeyondTrust zero-day
    USCyberScoop Asia Cybersecurity

    Suspected Chinese hackers with a proven knack for exploiting zero-days in security products are at it again, targeting BeyondTrust customers in attacks that researchers have traced back to late August. Mandiant researchers said a likely…

  2. Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
    USSecurityWeek Cybersecurity

    Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts. The post Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day appeared first on SecurityWeek .

  3. China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
    INThe Hacker News Cybersecurity

    The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The…

  4. ARMORY CASTLE Exploits BeyondTrust
    USGoogle Cloud Blog Cloud & Infrastructure

    Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support…