What Happened

A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support was discovered and is being actively exploited by the threat group ARMORY CASTLE, which is reportedly linked to China. The vulnerability carries a CVSS score of 9.3, later raised to 9.8 by the German Federal Office for Information Security (BSI). It allows unauthenticated attackers to upload files and potentially compromise host systems.

BeyondTrust issued a patch on October 8, 2026, but the vulnerability was publicly disclosed on October 15, 2026. Exploitation has been ongoing since late August 2026, with attackers using tools such as the SAWFLY web shell and BARECLAW backdoor for persistent access.

Who Is Affected

Organizations using BeyondTrust Remote Support are at risk. The vulnerability is actively exploited, and any unpatched instances are vulnerable to compromise. The BSI has issued a formal warning, indicating the severity and the need for immediate action.

Market Impact

• This event creates a strong trigger for outreach to BeyondTrust customers, especially those in patch management, threat detection, and incident response markets.
• The involvement of a state-linked threat group (ARMORY CASTLE) and the use of sophisticated tools (SAWFLY, BARECLAW) elevate the urgency for remediation.
• Organizations that have not yet applied the patch are at high risk of data breach or system compromise.

What to Watch

Monitor for additional disclosures or updates from BeyondTrust regarding this vulnerability. Also watch for reports of further exploitation by ARMORY CASTLE or related groups. The BSI warning may prompt regulatory actions in Germany and potentially other regions.

Related coverage

• Critical Cisco Secure Email Gateway Vulnerability Actively Exploited (CVE-2026-76519)
• Palo Alto Networks PAN-OS RCE Vulnerability CVE-2026-0322 Actively Exploited
• Ivanti Connect Secure VPN Zero-Day Actively Exploited; CISA Adds to KEV Catalog
• Zero-day vulnerability in Ivanti Connect Secure actively exploited