A nation-state cyber espionage group, Armory Castle, exploited a zero-day vulnerability in BeyondTrust Remote Support, impacting a small number of organizations.
The vulnerability or weakness
The flaw, tracked as CVE-2026-102764, involves improper origin validation in an internal messaging component, allowing remote attackers to perform file operations on the affected appliance.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-102764 | 9.3 | CRITICAL | Yes, added 2026-10-16 | 2026-10-19 |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations may face disruptions in remote support operations and potential data breaches, impacting their operations and reputation.
Industries affected
IT management and cybersecurity sectors are primarily affected.
Users affected
Users of BeyondTrust Remote Support could have their systems compromised, leading to unauthorized access and potential data loss.
