ARMORY CASTLE Exploits BeyondTrust
Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints. The successful exploitation of this vulnerability results in the arbitrary upload of files. During an incident response engagement, Mandiant identified evidence that ARMORY CASTLE, a suspected PRC-nexus espionage threat actor (formerly tracked as UNC5221 ), exploited this vulnerab
Read at Google Threat Intelligence Group (Mandiant)
- Vendor
- BeyondTrust
- Product
- Remote Support / PRA
- EPSS
- 0.19 (p97)
- Exploitation
- observed in the wild
- Fix
- available
- Exposure class
- Remote access
Why it ranks 64 (High)
- Exploitation observed in the wild
- EPSS 0.19 (elevated)
- Exposed product class: remote access
- Covered by 8 independent sources
- Fix available
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Google Threat Intelligence Group (Mandiant) (cloud.google.com)
- CVE-2026-102764 on this site · NVD · CVE.org · Vulnpedia
- CVE-2023-46805 on this site · NVD · CVE.org · Vulnpedia
- CVE-2024-21887 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.