China-Linked Hackers Exploited BeyondTrust Zero-Day Since August

· Cybersecurity · United States · China

BeyondTrust warned customers on Thursday to patch a critical vulnerability in its Remote Support (formerly Bomgar) product that has been exploited as a zero-day in attacks since late August 2026. The flaw, tracked as CVE-2026-102764 with a CVSS score of 9.3, is an improper origin validation issue. The China-nexus espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) used the flaw for initial access, deployed custom tools, and deleted logs and artifacts to cover its tracks. An alleged Chinese state-backed group is conducting espionage attacks using the vulnerability. The disclosure adds to a week of exploited edge-device flaws, following vulnerabilities in Ivanti, Cisco and Palo Alto Networks products that also came under fire.

Why it matters：Zero-day exploitation of remote support and edge devices by state-linked groups lets attackers bypass perimeter defenses and persist inside enterprise networks, putting every organization relying on third-party IT support software at risk and raising pressure on vendors to accelerate patching and disclosure.

Key points

  • CVE-2026-102764 carries a CVSS score of 9.3 and affects BeyondTrust Remote Support.
  • The flaw has been exploited since late August 2026, with attackers deleting logs and artifacts.
  • The campaign is attributed to Armory Castle, also tracked as UNC5221 or Warp Panda.

Sources (original reporting)

More stories from this day