Chinese hackers exploit critical BeyondTrust flaw for persistent network access

A suspected Chinese state-sponsored group has actively exploited a critical authentication bypass vulnerability in BeyondTrust Remote Support appliances, InfoSecurity Magazine and CISA reported. Google issued a warning regarding the activity, which involved a group tracked as Armory Castle, according to InfoSecurity Magazine. CISA confirmed that hackers are actively exploiting the security bug to gain initial access and establish persistence on affected networks. [1][2]

The vulnerability, identified as CVE-2026-102764, carries a CVSS severity rating of 9.3, InfoSecurity Magazine reported. CISA noted that the flaw impacts BeyondTrust Remote Support versions 26.2.3 and earlier. InfoSecurity Magazine stated that the hackers began exploiting the zero-day flaw in August 2026 to escalate privileges and secure long-term access, while as FTMQ Security reported earlier, the attackers used the flaw to compromise credential vaults and establish footholds for lateral movement. [1][2][11][12]

BeyondTrust publicly disclosed the vulnerability on October 15, after releasing a security fix on October 8 for both cloud-hosted software-as-a-service and self-hosted deployments, InfoSecurity Magazine reported. BeyondTrust withheld the technical details of the flaw at the time of disclosure. [1]

CISA urges organizations running self-hosted appliances to apply security updates immediately. Software patches are available for supported versions starting from 24.3.1, but CISA warned that systems running older releases must be upgraded first before applying the fix. [2]