Threat Advisories & Vulnerability Intelligence

Actively exploited critical vulnerability in BeyondTrust Remote Support (CVE-2026-102764)

Overview On October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS) , its platform for remotely troubleshooting and administering endpoints. Tracked as CVE-2026-102764 and assigned a CVSSv4 score of 9.3 , the vulnerability allows unauthenticated remote attackers to perform file operations on an affected appliance without user interaction.

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.

BeyondTrust patches zero-day exploited in attacks since August

BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August.

Cookie	Duration	Description
__cfduid	1 month	The cookie is used by CloudFare to identify individual clients behind a shared IP address and apply security settings on a per-client basis. It does not correspond to any user ID in the web application and does not store any personally identifiable information.
cookielawinfo-checkbox-advertisement	1 year	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Advertisement".
cookielawinfo-checkbox-analytics	1 year	This cookies is set by GDPR Cookie Consent WordPress Plugin. The cookie is used to remember the user consent for the cookies under the category "Analytics".
cookielawinfo-checkbox-functional	1 year	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	1 year	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	1 year	No description
cookielawinfo-checkbox-performance	1 year	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
pll_language	1 year	The cookie stores the language code of the last browsed page.

Cookie	Duration	Description
_clck	1 year	Used by Microsoft Clarity to store a unique user ID
_clsk		Microsoft Clarity analytics application
_ga	2 years	This cookie is installed by Google Analytics. The cookie is used to calculate visitor, session, campaign data and keep track of site usage for the site's analytics report. The cookies store information anonymously and assign a randomly generated number to identify unique visitors.
_ga_L2RPNQR0FJ	2 years	This cookie is set by Google Analytics 4 to persist session state and count sessions for this property.
_gat_gtag_UA_44752404_1	1 minute	No description
_gid	1 day	This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a website and helps in creating an analytics report of how the wbsite is doing. The data collected including the number visitors, the source where they have come from, and the pages viisted in an anonymous form.
_lfa	2 years	This cookie is set by the provider Leadfeeder. This cookie is used for identifying the IP address of devices visiting the website. The cookie collects information such as IP addresses, time spent on website and page requests for the visits.This collected information is used for retargeting of multiple users routing from the same IP address.
CLID	1 year	Microsoft Clarity
of.tracking	1 year
ofs
SL_C_23361dd035530_KEY		Outfunnel Campaign
SL_C_23361dd035530_SID		Outfunnel Campaign
SL_C_23361dd035530_VID		Outfunnel Campaign
SM	session	Used in synchronizing the MUID across Microsoft domains.
SRM_B	1 year 24 days	Identifies unique web browsers visiting Microsoft sites
vuid	2 years	This domain of this cookie is owned by Vimeo. This cookie is used by vimeo to collect tracking information. It sets a unique ID to embed videos to the website.

Cookie	Duration	Description
__oppref	30 days	Cookie used by OpenAI Ads to measure the performance of ads on ChatGPT.
_gcl_au	3 months	This cookie is set by Google Tag Manager and Google Ads to measure how well advertising performs and to attribute conversions to ad clicks.
ANONCHK	10 minutes	This cookie is used for storing the session ID for a user. This cookie ensures that clicks from advertisement on the Bing search engine are verified and it is used for reporting purposes and for personalization.
MUID	1 year 24 days	Used by Microsoft as a unique identifier. The cookie is set by embedded Microsoft scripts. The purpose of this cookie is to synchronize the ID across many different Microsoft domains to enable user tracking.
oaacct	30 days	Stores which EXEO OpenAI ads account referred the visit, so that conversions are measured in the right account. Set only after advertising consent.

Threat advisories that tell you what to do next

Actively exploited critical vulnerability in BeyondTrust Remote Support (CVE-2026-102764)

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

BeyondTrust patches zero-day exploited in attacks since August

Get in touch