What happened
In late August 2026, a China-linked cyber espionage group identified as Armory Castle exploited a newly disclosed zero-day flaw in BeyondTrust Remote Support, previously known as Bomgar. The vulnerability, designated CVE-2026-102764, is related to improper origin validation within an internal messaging component, allowing the threat actor to potentially take control of remote support servers. This security flaw was exploited actively in the wild prior to a patch being available, highlighting its critical severity with a CVSS score of 9.3. The vulnerability was not accompanied by an initial patch from the vendor at the time of disclosure, increasing the risk of widespread exploitation and impact on affected systems.
Who is affected
Any organisation running BeyondTrust Remote Support that has not applied mitigations or patches related to CVE-2026-102764 is vulnerable. While specific deployment details are not available, the reported active exploitation indicates a significant risk to environments that rely on this remote support software without additional protective controls.
Recommended actions
- Review network perimeter controls to restrict access to BeyondTrust Remote Support servers, especially from untrusted networks.
- Monitor logs for indicators of compromise related to unauthorized access or suspicious activity within remote support components.
- Prepare to apply security updates or mitigations as soon as they are released by the vendor, and verify the integrity of existing installations.
