<![CDATA[🔴 Critical: China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers]]>A China-nexus cyber espionage group tracked as Armory Castle, previously known as UNC5221 or Warp Panda, exploited a newly disclosed flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.

The vulnerability is tracked as CVE-2026-102764 and carries a CVSS score of 9.3. It stems from improper origin validation in an internal messaging component, allowing attackers to take over remote support servers.

Key details:

  • Targeted product: BeyondTrust Remote Support (formerly Bomgar)
  • Threat actor: Armory Castle (also tracked as UNC5221 / Warp Panda)
  • Exploitation window: late August 2026, as a zero-day
  • Vulnerability type: improper origin validation in an internal messaging component
  • Severity: CVSS 9.3

Organizations running BeyondTrust Remote Support should treat this as high priority given active exploitation in the wild.

Source: info@thehackernews.com (The Hacker News)

Has your organization reviewed its BeyondTrust Remote Support deployment for exposure tied to this campaign?

]]>https://xploitlk.com/topic/706/critical-china-linked-hackers-exploited-beyondtrust-zero-day-to-take-over-remote-support-serversRSS for NodeTue, 27 Oct 2026 08:20:33 GMTFri, 16 Oct 2026 10:30:19 GMT60