GoKawiilChinese hackers exploited zero-day in BeyondTrust Remote Support, company confirms
BeyondTrust disclosed that the China-linked group Mandiant tracks as Armory Castle exploited a critical zero-day vulnerability, CVE-2026-102764, in its Remote Support appliances starting August 29, 2026. The flaw, rated 9.3 CVSS, stemmed from an internal messaging component failing to validate message origin, letting attackers deploy a custom PHP webshell called SAWFLY within 11 minutes of exploitation.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident is the latest in a string of exploited edge-device vulnerabilities this week affecting Ivanti, Cisco, and Palo Alto Networks, suggesting attackers are increasingly targeting remote-access and perimeter technologies as entry points. Because Remote Support tools grant deep control over enterprise systems, and BeyondTrust says it serves over 20,000 customers including most of the Fortune 100, the compromise could expose a large attack surface if unpatched instances remain online.
- BeyondTrust confirmed a China-nexus actor exploited a critical zero-day (CVE-2026-102764, CVSS 9.3) in Remote Support appliances.
- Attackers deployed a custom webshell named SAWFLY within 11 minutes of exploitation, indicating highly automated tradecraft.
- The flaw adds to a broader pattern this week of actively exploited edge vulnerabilities across major vendors including Ivanti, Cisco, and Palo Alto Networks.
YubiKey 5C NFC Security Key — With remote-access tools like BeyondTrust being targeted by zero-day exploits, hardening authentication on privileged accounts is more critical than ever. A hardware security key adds a strong phishing-resistant layer of protection for IT admins managing remote support and edge infrastructure.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Nate Nelson, 2026-10-16
Published there as: “BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.