October 31, 2026
- Rapid7 analyzed an unauthenticated file upload to RCE in BeyondTrust Remote Support, CVE-2026-102764 (Rapid7). · Vulnerabilities & Exploits
in Open-Weight Model Turns Firefox's Patch Gap Into Working Exploits
tagged
[beyondtrust]
5 editions · 5 items
October 17, 2026
- CISA added CVE-2026-102764 (CVSS 9.3, improper origin validation in an internal messaging component) in BeyondTrust Remote Support to KEV and told organisations to apply the BT26-05-RS patch, restrict appliance exposure, and run network and memory forensics — hunting for unrecognised privileged sessions, stray script files, gaps in log forwarding and unauthorised session-policy changes (CISA). Versions ≤26.2.3 are affected, SaaS tenants are already patched, and Armory Castle (previously UNC5221 / Warp Panda) has been exploiting it as a zero-day since late August, deploying custom tooling and deleting logs (SecurityWeek). CERT-SE and NCSC-NL echoed the advisory (CERT-SE) (earlier coverage). · Active Exploitation
in Thirty-Seven Years of a Signed Short, and a Root Shell on OpenBSD
October 16, 2026
- Suspected PRC-nexus actor ARMORY CASTLE exploited BeyondTrust CVE-2026-102764 as a zero-day in late August. ARMORY CASTLE, formerly tracked as UNC5221, used the critical unauthenticated file-upload flaw against BeyondTrust Remote Support appliances; successful exploitation can lead to host-level control. Google Threat Intelligence Group ties the observed exploitation to the actor. · Vulnerabilities & Exploits
in The Ad-Tech Pipeline Delivered Zero-Click Mercenary Spyware
July 8, 2026
- BeyondTrust patched two critical pre-auth flaws in Remote Support (RS) and Privileged Remote Access (PRA), including CVE-2026-40138 (CVSS 9.2), that let unauthenticated attackers take over affected appliances. Given these products' privileged position, prioritize patching. BleepingComputer, The Hacker News · Vulnerabilities & Exploits
in Synacktiv Drops a Kerberos Reflection Bypass That Hands Attackers SYSTEM
July 7, 2026
- BeyondTrust Remote Support and PRA CVE-2026-40138 is a critical pre-authentication access-control bypass in the products' authentication subsystem — a notable target given BeyondTrust's role in privileged access (Dark Web Informer). · Vulnerabilities & Exploits
in A 16-Year-Old KVM Flaw Punches Through the Hypervisor Boundary