BeyondTrust Discloses Zero-Day Vulnerability Exploited by China-Nexus Group Armory Castle

BeyondTrust has disclosed CVE-2026-102764, an improper origin validation flaw in its Remote Support appliances, which has been exploited as a zero-day by the China-nexus group Armory Castle (also known as UNC5221 / Warp Panda) since late August 2026. The vulnerability allows unauthenticated remote attackers to perform file operations, leading to root persistence and credential harvesting. Patches were automatically applied to SaaS customers, while self-hosted systems require an update.