China-linked group exploited a BeyondTrust Remote Support zero-day
October 16, 2026 (Exploited August 29, disclosed October 16, 2026)
BeyondTrust disclosed CVE-2026-102764 (severity 9.3), a flaw in how an internal messaging component of Remote Support checks where messages come from, which lets a remote attacker perform file operations on the appliance. By BeyondTrust's timeline, a China-nexus espionage group tracked as Armory Castle (also UNC5221 or Warp Panda) used it as a zero-day on a single self-hosted appliance on August 29. SaaS customers were patched by October 9. CISA listed the flaw on October 16 with a federal deadline of October 19.
Why it matters
Remote-support tools have privileged reach into many endpoints, which makes them valuable to espionage groups.
What defenders can take from it
- Self-hosted customers should patch immediately and follow CISA's advisory, including checking for earlier compromise.
- Limit internet exposure of remote-support appliances.