China-nexus cyber espionage group Armory Castle exploited a newly disclosed security flaw in BeyondTrust Remote Support as a zero-day in late August 2026.
The vulnerability, tracked as CVE-2026-102764, has a CVSS score of 9.3. It is an improper origin validation flaw in an internal messaging component.
This flaw could be exploited by a remote unauthenticated attacker to take over remote support servers.
By the numbers
- CVSS score
- 9.3
- Exploitation date
- August 2026
Sources and references
Original report
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 00M1WPKP
Cite this
APA
Interestana AI Editorial. (2026, October 16). China Hackers Exploit BeyondTrust Zero-Day. Interestana. https://interestana.com/articles/china-linked-hackers-exploited-beyondtrust-zero-day-to-take-over-remote-support-servers-00m1wpkp
MLA
“China Hackers Exploit BeyondTrust Zero-Day.” Interestana, 16 Oct. 2026, interestana.com/articles/china-linked-hackers-exploited-beyondtrust-zero-day-to-take-over-remote-support-servers-00m1wpkp.
Chicago
Interestana AI Editorial. “China Hackers Exploit BeyondTrust Zero-Day.” Interestana, October 16, 2026. https://interestana.com/articles/china-linked-hackers-exploited-beyondtrust-zero-day-to-take-over-remote-support-servers-00m1wpkp.
BibTeX
@misc{interestana_00m1wpkp,
author = {{Interestana AI Editorial}},
title = {{China Hackers Exploit BeyondTrust Zero-Day}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/china-linked-hackers-exploited-beyondtrust-zero-day-to-take-over-remote-support-servers-00m1wpkp},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/china-linked-hackers-exploited.html}
}Credit the source
Original reporting: The Hacker News, “China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers”, https://thehackernews.com/2026/10/china-linked-hackers-exploited.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe