A week chock full of new high-severity and actively exploited edge vulnerabilities continues with a Chinese cyberattack built around a critical flaw in BeyondTrust Remote Support appliances.
This week, Ivanti, Cisco, Palo Alto Networks all disclosed major, already abused vulnerabilities in their core edge technologies. Might as well throw one more on the pile, then. According to a BeyondTrust blog post, the China-nexus threat actor tracked by Mandiant as "Armory Castle" (formerly UNC5221, aka UTA0178) exploited a critical BeyondTrust Remote Support vulnerability as a zero-day starting on Aug. 29, 2026. The critical vulnerability, tracked as CVE-2026-102764, earned a 9.3 CVSS score and is derived from an internal messaging component that didn't properly validate the origin of incoming messages.
It doesn't get much more serious than a critical bug in a remote access tool. IT teams use Remote Support to connect to and control computers and servers at a distance, and by exploiting it, attackers were able to do more or less the same.
Dark Reading reached out to BeyondTrust for comment on this story.