A week chock full of new high-severity and actively exploited edge vulnerabilities continues with a Chinese cyberattack built around a critical flaw in BeyondTrust Remote Support appliances.
This week, Ivanti, Cisco, Palo Alto Networks all disclosed major, already abused vulnerabilities in their core edge technologies. Might as well throw one more on the pile, then. According to a BeyondTrust blog post, the China-nexus threat actor tracked by Mandiant as “Armory Castle” (formerly UNC5221, aka UTA0178) exploited a critical BeyondTrust Remote Support vulnerability as a zero-day starting on Aug. 29, 2026. The critical vulnerability, tracked as CVE-2026-102764, earned a 9.3 CVSS score and is derived from an internal messaging component that didn’t properly validate the origin of incoming messages.
It doesn’t get much more serious than a critical bug in a remote access tool. IT teams use Remote Support to connect to and control computers and servers at a distance, and by exploiting it, attackers were able to do more or less the same.
Dark Reading reached out to BeyondTrust for comment on this story.
China vs. Edge Bugs: The Same Old Story
Remote Support is a common enough enterprise IT solution. BeyondTrust claims to serve more than 20,000 customers, including 75 of the Fortune 100.
Exactly how many of those customers use Remote Support specifically is unclear. The best estimate might have been made earlier this year, when an AI agent uncovered a 9.9 CVSS-rated pre-authentication flaw in Remote Support and its companion product, Privileged Remote Access (PRA). At the time, researchers found around 11,000 Remote Support instances exposed to the Internet, across the cloud and on-premises.
This time around, attackers got to the bug before any blue team agents did. The exploitation was characterized by speed, in fact, as Armory Castle deployed its new custom PHP Webshell “SAWFLY” just 11 minutes after weaponizing the vulnerability.
Then the cyber-espionage actor got to business. According to a a report from Mandiant and Google’s Threat Intelligence Group (GTIG), Armory Castle shot straight for the appliance’s built-in secrets management database, systematically searching for passwords, application programming interface (API) keys, and endpoint credentials, before dumping all admin credentials. c
It established persistence with a script, combatted forensic analysts by deleting system, Web server, and application logs, and escalated from a standard service account to full admin privileges. That allowed it to launch remote sessions with downstream systems, perform internal network reconnaissance, and download and exfiltrate sensitive internal documents from victims’ desktops. It also debuted a second, new custom tool, “BARECLAW,” for SOCKS5 tunnelling.
It was able to do all that thanks to what Mandiant considered a “deep understanding” of BeyondTrust’s technical innards.
BeyondTrust made a CVE-2026-102764 patch available on Oct. 9 and implored organizations with on-prem Remote Support to update as soon as possible. All customers would be well advised to hunt for evidence of exploitation, and, wherever possible, severely restrict Internet exposure for their network management tools.
Such advice is familiar — thought not always practiced — for security teams. This time around, perhaps in acknowledgement of how little cybersecurity advice is actually heeded around edge devices, Mandiant and GTIG researchers offered organizations three potential options for how to protect themselves, based on their operational needs, risk tolerance, and whether they’ve already found evidence of compromise.
First and foremost, researchers advised that customers patch. They also suggested isolating at-risk appliances — terminating access paths, restricting outbound traffic to vendor endpoints only, and redeploying from clean images.
Organizations can also apply compensating controls of various kinds: network restrictions, such as placing a Web Application Firewall (WAF) in front of edge appliances; credential and configuration hygiene, rotating credentials, reviewing and revoking sessions, etc.; and control plane restrictions, minimizing permissions, keeping credentials in an external vault rather than the appliance’s built-in vault; along with plenty more.
A Bad Week for Network Security Vendors
Edge device bugs are like the milkman: they come pretty reliably every week (and you’re going to have problems if you miss them). Even still, the past few days have producede several serious ones.
It all began on Oct. 13, when researchers from Volexity revealed that an unknown threat actor has been abusing a zero-day exploit chain in fully updated Ivanti Connect Secure (ICS) VPN appliances. The chain combined all of the worst kinds of vulnerabilities out there: authentication bypass, remote code execution (RCE), and privilege escalation. The former two, tracked together as CVE-2026-104935, earned a “high” CVSS score of 8.6 out of 10.
The next day brought CVE-2026-76519, a vulnerability in the Advanced Malware Protection (AMP) feature of Cisco’s Secure Email Gateway (SEG), which allowed remote attackers to write arbitrary files to the device’s operating system. That issue earned a cool CVSS 9.8 out of 10, and was added to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog the same day.
Also added to CISA’s KEV catalog that same day was CVE-2026-0322, a high-severity RCE vulnerability with an 8.6 CVSS score in Palo Alto Networks’s PAN-OS, the operating system underpinning all of the vendor’s Firewall technology.
A day later, Mandiant and GTIG released its Armory Castle research. Separately, GreyNoise published a blog post about a threat actor it tracks as “skynox7” building a residential proxy network out of unpatched, Internet-exposed household appliances like network-attached storage (NAS) and network video recorders (NVRs).
“At this point, these types of vulnerabilities in network devices or tools that manage large portions of the IT of an organization are happening one every month or so,” laments Bambenek Consulting president John Bambenek. “Enterprises need to stand up in unison and tell these companies it’s time to get serious about security.”
