[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fk8MuCVqKG7Yt8v8uR-cPycLC1rfIcXqADYh-Pf8QQz8":3},{"article":4,"iocs":55,"watch_terms":78,"solutions":79,"lesson":179},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"d6b9b107-745b-4f52-8b4b-f165d6493199","BeyondTrust patches zero-day exploited in attacks since August","beyondtrust-patches-zero-day-exploited-in-attacks-since-august-166fdf","BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]","BeyondTrust has released a patch for a critical zero-day vulnerability (CVE-2026-102764) in its Remote Support software that has been actively exploited since late August. The authentication bypass flaw allows unprivileged attackers to perform file operations and escalate privileges, with suspected China-nexus actors like Armory Castle (Warp Panda) and Silk Typhoon leveraging it for espionage and network access.","BeyondTrust patches critical zero-day vulnerability in Remote Support exploited since August.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fbeyondtrust-patches-zero-day-exploited-in-attacks-since-august\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F16\u002FBeyondTrust.jpg","2026-10-16T06:18:08+00:00","2026-10-16T08:00:04.327643+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Remote Support","product",{"name":21,"type":22},"BeyondTrust","vendor",{"name":24,"type":25},"Armory Castle","threat_actor",{"name":27,"type":25},"Warp Panda",{"name":29,"type":25},"Silk Typhoon",{"name":31,"type":25},"UNC5221","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66,68,70,73,76],{"type":57,"value":58,"context":59},"cve","CVE-2026-102764","Zero-day authentication bypass vulnerability in BeyondTrust Remote Support",{"type":57,"value":61,"context":62},"CVE-2023-4966","Previously exploited Citrix NetScaler vulnerability by Armory Castle",{"type":57,"value":64,"context":65},"CVE-2023-46805","Previously exploited Ivanti Connect Secure vulnerability by Armory Castle",{"type":57,"value":67,"context":65},"CVE-2024-21887",{"type":57,"value":69,"context":65},"CVE-2025-0282",{"type":57,"value":71,"context":72},"CVE-2026-1731","Previously exploited RCE vulnerability in BeyondTrust Remote Support",{"type":57,"value":74,"context":75},"CVE-2024-12356","Previously exploited zero-day in BeyondTrust systems by Silk Typhoon",{"type":57,"value":77,"context":75},"CVE-2024-12686",[21,18],{"controls":80,"vendors":167},[81,110,139],{"slug":82,"name":83,"problem":84,"products":85},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":111,"name":112,"problem":113,"products":114},"patch-management","Automated patch management","Known holes get closed in days, not months.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":140,"name":141,"problem":142,"products":143},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[144,152,160],{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":161,"vendor_name":162,"vendor_logo":163,"product_slug":164,"product_name":162,"url":165,"description":166},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",[168,173],{"slug":169,"name":21,"logo_path":170,"roles":171},"beyondtrust","\u002Fvendor-logos\u002Fbeyondtrust.png",[172],"affected",{"slug":174,"name":175,"logo_path":176,"roles":177},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[178],"reported_by",{"slug":180,"title":181,"body":182,"framework_refs":183,"framework_notes":196},"beyondtrust-zero-day-exploited-for-months-before-patch","BeyondTrust Zero-Day Exploited for Months Before Patch","A critical authentication bypass vulnerability in BeyondTrust's Remote Support software was actively exploited by suspected nation-state actors for several months before a patch was released, highlighting the danger of delayed remediation in privileged access tools. The flaw allowed unprivileged attackers to bypass authentication, perform unauthorized file operations, and escalate privileges — a devastating combination in software designed to provide trusted remote access. Because BeyondTrust is widely used in enterprise and government environments, compromising it grants attackers a highly privileged foothold into target networks. This incident underscores that remote access and privileged access management (PAM) tools are high-value targets that require accelerated patching cycles and continuous monitoring. The nation-state nexus further illustrates that espionage actors actively research and exploit trusted security tooling as a primary intrusion vector.",[184,185,186,187,188,189,190,191,192,193,194,195],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 AU-6: Audit Record Review and Analysis","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","CISA Known Exploited Vulnerabilities (KEV) Catalog","MITRE ATT&CK T1078: Valid Accounts","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]