Threats Tagged 'beyondtrust'

CVE-2026-102764 is a critical authentication bypass vulnerability in the BeyondTrust Remote Support platform affecting versions 26.2.3 and earlier. It allows unauthenticated remote attackers to perform file operations without user interaction. Exploitation in the wild has been confirmed, with compromises involving arbitrary file uploads, deployment of web shells and tunneling tools, root escalation, credential vault extraction attempts, persistence mechanisms, and log deletion. The threat actor ARMORY CASTLE, linked to PRC-nexus espionage, is attributed to these attacks. CISA has added this vulnerability to its Known Exploited Vulnerabilities list. Emergency patching and compromise investigations are required, as patching alone does not remove attacker persistence.