Security1 hOctober 16, 2026, 13:18

BeyondTrust patches zero-day CVE-2026-102764 exploited since August

BeyondTrust warned customers to patch a critical authentication bypass (CVE-2026-102764) in Remote Support affecting versions 26.2.3 and earlier, exploited in zero-day attacks since late August. SaaS customers were patched on October 8, but self-hosted appliances require manual updates. The attacks are attributed to the suspected China-nexus group Armory Castle (Warp Panda).

BleepingComputer

Open source

BeyondTrust patches zero-day CVE-2026-102764 exploited since August

CVE-2026-102764 affects Remote Support 26.2.3 and earlier versions
SaaS customers patched October 8; self-hosted installs need manual updates
Shadowserver tracks over 1,400 BeyondTrust RS instances exposed online
Attackers escalated to root and deployed Sawfly web shell and Bareclaw tunneler

#BeyondTrust#Mandiant#CrowdStrike

Mandiant: two Citrix NetScaler zero-days exploited since September

Security

Kiteworks Urges Server Shutdown Over Advanced Forms Zero-Day Threat

Security

Citrix discloses eight NetScaler vulnerabilities, two already exploited

Security

BeyondTrust patches zero-day CVE-2026-102764 exploited since August

Mandiant: two Citrix NetScaler zero-days exploited since September

Kiteworks Urges Server Shutdown Over Advanced Forms Zero-Day Threat

Citrix discloses eight NetScaler vulnerabilities, two already exploited

Microsoft patches record 1,413 vulnerabilities, including exploited Windows Shell zero-day