beyondtrust News Articles

(TLP:CLEAR) Vulnerability Notification - BeyondTrust Remote Support Actively Exploited - WaterISAC

ACTION MAY BE REQUIRED for utilities using self-hosted BeyondTrust Remote Support (formerly Bomgar) appliances running version 26.2.3 or earlier, as well as self-hosted BeyondTrust Privileged Remote Access...

2 weeks ago

China Hacked BeyondTrust Enterprise Vaults With Zero-Day Active for Seven Weeks

BeyondTrust zero-day CVE-2026-102764 was exploited by Chinese state hackers for seven weeks before disclosure, letting attackers drain enterprise credential vaults and plant a reboot-surviving

2 weeks ago

CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild - IT Security News

Overview On October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS), its platform for remotely troubleshooting and administering endpoints. Tracked as CVE-2026-102764...

2 weeks ago

BeyondTrust Zero-Day Exploited by China-Linked Hackers

Google says China-linked hackers exploited a critical BeyondTrust zero-day. See affected versions, patch guidance, and what defenders should check now.

3 weeks ago

China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Go

The suspected PRC-aligned group Armory Castle has been observed exploiting the newly disclosed flaw for long-term persistence

3 weeks ago

Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks - IT Security News

2026-10-16 12:10 A suspected China-nexus espionage group exploited a critical zero-day in BeyondTrust Remote Support, tracked as CVE-2026-102764. It then deleted logs to hide its activity....

3 weeks ago

BeyondTrust patches zero-day exploited in attacks since August

BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August.

3 weeks ago

Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

Chinese APT Armory Castle exploited a BeyondTrust vulnerability tracked as CVE-2026-102764 as a zero-day since August.

3 weeks ago

BeyondTrust Fixes CVSS 9.2 PAM Bypass in Tools State Hackers Have Targeted for 18 Months

BeyondTrust authentication bypass flaws CVE-2026-40138 and CVE-2026-40139, both CVSS 9.2, let unauthenticated attackers seize administrative control of every system managed by Remote Support and

BeyondTrust Patches Authentication Bypass Vulnerabilities  | eSecurity Planet

BeyondTrust has patched four RS and PRA vulnerabilities, including two critical authentication bypass flaws.

Surge in Bomgar RMM Exploitation Demonstrates Supply Chain Risk

The critical remote code execution flaw (CVE-2026-1731) in the remote monitoring and management tool can be exploited to spread ransomware.

BeyondTrust Flaw Used for Web Shells, Backdoors, and Data Exfiltration

CVE-2026-1731 in BeyondTrust RS and PRA is exploited for ransomware, web shells, C2, and data theft across multiple sectors

VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)

CVE-2026-1731 is an RCE vulnerability in identity platform BeyondTrust. This flaw allows attackers control of systems without login credentials.

Hackers probe, exploit newly patched BeyondTrust RCE flaw (CVE-2026-1731) - Help Net Security

Attackers are exploiting CVE-2026-1731 in internet-facing BeyondTrust Remote Support and Privileged Remote Access instances.

BeyondTrust Tools RCE Vulnerability Allows Attackers Execute Arbitrary Code

A newly disclosed vulnerability in BeyondTrust’s Remote Support (RS) and Privileged Remote Access (PRA) products has raised alarms across the cybersecurity community.

Serious PostgreSQL flaw exploited in US Treasury zero-day attack - Techerati

Researchers believe a zero-day weakness in PostgreSQL played a major role in hacks that were able to successfully breach the US Treasury.

PostgreSQL flaw exploited as zero-day in BeyondTrust breach

​Rapid7's vulnerability research team says attackers exploited a PostgreSQL security flaw as a zero-day to breach the network of privileged access management company BeyondTrust in December.

Rapid7 Flags New PostgreSQL Zero-Day Connected to BeyondTrust Exploitation

Rapid7 finds a new zero-day vulnerability in PostgreSQL and links it to chain of attacks against a BeyondTrust Remote Support product.

PostgreSQL patches SQLi vulnerability likely exploited in BeyondTrust attacks

Rapid7 researchers believe the BeyondTrust Remote Support attacks from December also exploited a zero-day flaw in PostgreSQL.

CISA: BeyondTrust flaw CVE-2024-12686 exploited in the wild | TechT...

A second BeyondTrust vulnerability, CVE-2024-12686, has been added to CISA's Known Exploited Vulnerabilities catalog in the past month.

CISA Adds Second BeyondTrust Flaw to KEV Catalog Amid Active Attacks

CISA adds BeyondTrust CVE-2024-12686 to KEV catalog; Treasury breach linked to Silk Typhoon exploits.

CISA orders agencies to patch BeyondTrust bug exploited in attacks

​CISA tagged a vulnerability in BeyondTrust's Privileged Remote Access (PRA) and Remote Support (RS) as actively exploited in attacks, ordering agencies to secure their systems within three weeks.