HighZero-DayCVE-2026-102764
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The Hacker News·Source published ·1 min read
What happened?
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a
Key details
- Armory Castle used a zero‑day in BeyondTrust Remote Support in late August 2026.
- The flaw is improper origin validation in an internal messaging component allowing remote file operations.
- Patches were released to all SaaS customers on October 9 2026.
- After compromise, attackers deployed the SAWFLY PHP web shell for encrypted remote access.
Affected
- Self‑hosted Remote Support versions 24.3.1 through 26.2.3 are affected.
- Versions older than 24.3.1 must be upgraded to apply the fix.
Fixes and mitigations
- SaaS customers received patches on October 9 2026.
What to look for
- Copy /bin/sh to /usr/bin/dbus-authd, set SUID root ownership.
- Modify haproxy.conf to expose BARECLAW to the internet.
- Tunnel traffic via BARECLAW custom SOCKS5 proxy.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.