Oct 16 – October 17, 2026 · 2 reports
- CISA added CVE-2026-102764 (CVSS 9.3, improper origin validation in an internal messaging component) in BeyondTrust Remote Support to KEV and told organisations to apply the BT26-05-RS patch, restrict appliance exposure, and run network and memory forensics — hunting for unrecognised privileged sessions, stray script files, gaps in log forwarding and unauthorised session-policy changes (CISA). Versions ≤26.2.3 are affected, SaaS tenants are already patched, and Armory Castle (previously UNC5221 / Warp Panda) has been exploiting it as a zero-day since late August, deploying custom tooling and deleting logs (SecurityWeek). CERT-SE and NCSC-NL echoed the advisory (CERT-SE) (earlier coverage). · Oct 17 · observed · as armory castle · Active Exploitation
- Suspected PRC-nexus actor ARMORY CASTLE exploited BeyondTrust CVE-2026-102764 as a zero-day in late August. ARMORY CASTLE, formerly tracked as UNC5221, used the critical unauthenticated file-upload flaw against BeyondTrust Remote Support appliances; successful exploitation can lead to host-level control. Google Threat Intelligence Group ties the observed exploitation to the actor. · Oct 16 · observed · via exposed service · as armory castle, unc5221 · Vulnerabilities & Exploits