ARMORY CASTLE zero-days BeyondTrust Remote Support
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
PRC-nexus actor ARMORY CASTLE exploited a zero-day in BeyondTrust Remote Support to upload arbitrary files; CVE now in CISA's KEV catalog.
CISecurity/MS-ISAC issued an advisory on CVE-2026-102764, a vulnerability in BeyondTrust Remote Support that stems from internal components failing to validate the origin of messages they receive, allowing arbitrary file upload operations on affected appliances. All self-hosted versions up to and including 26.2.3 are affected; BeyondTrust's SaaS offering has already been patched, but self-hosted deployments require manual patching.
Mandiant identified evidence that ARMORY CASTLE (formerly tracked as UNC5221), a suspected PRC-nexus espionage threat actor, exploited this flaw as a zero-day in late August 2026. Following successful exploitation, the actor used multiple TTPs to establish a foothold, escalate privileges, and move laterally within compromised environments. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 16, 2026, confirming active in-the-wild exploitation.
Defenders running self-hosted BeyondTrust Remote Support should apply the vendor patch immediately, verify SaaS instances are updated, and review logs for signs of unauthorized file operations, unexpected privilege escalation, or lateral movement originating from Remote Support appliances. Given confirmed exploitation by a sophisticated espionage actor against a widely-used remote access product, this should be treated as a high-priority patching action.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-beyondtrust-remote-support-could-allow-for-arbitrary-upload-of-files_2026-117
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs and actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,702 reports from 144 sources, 534 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs