{"metadata": {"vulnerability": "cve-2026-102764", "count": 98, "kinds": {"milestone": 5, "sighting": 69, "kev": 11, "other": 13}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0437", "record": "NCSC-2026-0437", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-29T16:29:20.011Z", "date_only": false, "value": "2026-09-29T16:29:20.011Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-102764", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T20:30:32.240Z", "date_only": false, "value": "2026-10-15T20:30:32.240Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-102764", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T20:30:32.240Z", "date_only": false, "value": "2026-10-15T20:30:32.240Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / BT", "record": "cve-2026-102764", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T20:38:02.051Z", "date_only": false, "value": "2026-10-15T20:38:02.051126Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117446847856201480", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "172f0c7d-ad67-44fe-b33a-0c2d0d1b8b2c", "content": "CVE-2026-102764 Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support The vulnerability exists within internal components of BeyondTrust\u2019s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.\nhttps://www.cve.org/CVERecord?id=CVE-2026-102764https://nvd.nist.gov/vuln/detail/CVE-2026-102764https://www.beyondtrust.com/blog/entry/bt26-05https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066#beyondtrust #BeyondTrust #RemoteSupport#CVE_2026_102764#bot", "url": "https://infosec.exchange/users/cve/statuses/117446847856201480"}, {"timestamp": "2026-10-15T21:17:00Z", "date_only": false, "value": "2026-10-15T21:17:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-PF95-V8M2-73Q8", "record": "GHSA-PF95-V8M2-73Q8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-15T21:17:00.117Z", "date_only": false, "value": "2026-10-15T21:17:00.117", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102764", "record": "FKIE_CVE-2026-102764", "field": "published"}, {"timestamp": "2026-10-15T21:36:14Z", "date_only": false, "value": "2026-10-15T21:36:14Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PF95-V8M2-73Q8", "record": "GHSA-PF95-V8M2-73Q8", "field": "published"}, {"timestamp": "2026-10-15T22:00:05.496Z", "date_only": false, "value": "2026-10-15T22:00:05.496625Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxx2psrclf2w", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "c403b015-f80d-4b3e-bcb3-92cabf8e1fda", "content": "CVE-2026-102764\nThe internal parts of BeyondTrust Remote Support do not properly check where messages come from. This weakness could let a bad actor tell the system to create, change, or delete files on the appliance. Apply\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxx2psrclf2w"}, {"timestamp": "2026-10-15T22:03:43.570Z", "date_only": false, "value": "2026-10-15T22:03:43.570855Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bigbadw0lf.bsky.social/post/3mxx2wbpcsc22", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "d23e0a45-9b68-4947-8da5-2711f39c2a09", "content": "New blog detailing zero day exploitation of CVE-2026-102764 in BeyondTrust Remote Support by \ud83c\udde8\ud83c\uddf3 nexus espionage actor ARMORY CASTLE (fka UNC5221). \n\ncloud.google.com/blog/topics/...", "url": "https://bsky.app/profile/bigbadw0lf.bsky.social/post/3mxx2wbpcsc22"}, {"timestamp": "2026-10-15T22:07:53.473Z", "date_only": false, "value": "2026-10-15T22:07:53.473895Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxx35qhxkj24", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "d6e696df-e5a2-4635-93a6-8894f3285f9c", "content": "\ud83d\udea8 CVE-2026-102764 \u2014 CVSS 9.3 CRITICAL\n\nThe vulnerability exists within internal components of BeyondTrust\u2019s Remote Support product. The components...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-102764\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxx35qhxkj24"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-102764", "field": "timestamps.asserted_at", "uuid": "a78314a4-fcef-4227-9854-abe2f272b931", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": true, "value": "2026-10-16", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-102764", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": true, "value": "2026-10-16", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-102764", "field": "evidence.0.details.date_added", "uuid": "a78314a4-fcef-4227-9854-abe2f272b931", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-102764", "field": "timestamps.first_seen_at", "uuid": "a78314a4-fcef-4227-9854-abe2f272b931", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-102764", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102764", "record": "FKIE_CVE-2026-102764", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-102764", "field": "status.status_updated_at", "uuid": "a78314a4-fcef-4227-9854-abe2f272b931", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-102764", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-10-16T01:51:08Z", "date_only": false, "value": "2026-10-16T01:51:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/beyondtrust-rilevato-sfruttamento-in-rete-della-cve-2026-102764", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "279ce48b-ae92-4807-9b10-7cb2f0f08194", "url": "https://www.acn.gov.it/portale/w/beyondtrust-rilevato-sfruttamento-in-rete-della-cve-2026-102764"}, {"timestamp": "2026-10-16T01:59:16Z", "date_only": false, "value": "2026-10-16T01:59:16.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0437", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "fcc1da66-d476-45de-b11c-055a4e861226", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0437"}, {"timestamp": "2026-10-16T04:04:01.618Z", "date_only": false, "value": "2026-10-16T04:04:01.618981Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxxp2lf7ta25", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "d54755d7-2871-4423-b075-4c0bfce2cb0f", "content": "@mandiant.com\nARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 for root access, credential theft and persistence.\n-\nIOCs: CVE-2026-102764, SAWFLY, BARECLAW\n-\n#ARMORYCASTLE #CVE-2026-102764 #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mxxp2lf7ta25"}, {"timestamp": "2026-10-16T05:00:00Z", "date_only": false, "value": "2026-10-16T05:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "e3f9c697-56df-427b-9252-249acb7225c7", "url": "https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog"}, {"timestamp": "2026-10-16T05:00:00Z", "date_only": false, "value": "2026-10-16T05:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "68a27633-488d-4bf5-9233-f278c601940c", "url": "https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support"}, {"timestamp": "2026-10-16T06:18:47.223Z", "date_only": false, "value": "2026-10-16T06:18:47.223016Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mxxwlkash52j", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "6f997e9e-d823-4780-95c0-4de97c187430", "content": "Top 3 CVE for last 7 days:\nCVE-2026-92392: 65 interactions\nCVE-2026-104935: 46 interactions\nCVE-2026-97229: 38 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-0322: 21 interactions\nCVE-2026-99999: 15 interactions\nCVE-2026-102764: 14 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mxxwlkash52j"}, {"timestamp": "2026-10-16T06:20:54Z", "date_only": false, "value": "2026-10-16T06:20:54+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-102764", "field": "timestamps.asserted_at", "uuid": "e43a806f-d83d-45f3-abca-10194c8b5544", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-16T06:20:54Z", "date_only": false, "value": "2026-10-16T06:20:54+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-102764", "field": "timestamps.first_seen_at", "uuid": "e43a806f-d83d-45f3-abca-10194c8b5544", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-16T06:20:54Z", "date_only": false, "value": "2026-10-16T06:20:54+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-102764", "field": "status.status_updated_at", "uuid": "e43a806f-d83d-45f3-abca-10194c8b5544", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-16T06:20:54.577Z", "date_only": false, "value": "2026-10-16T06:20:54.577Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-102764", "field": "evidence.0.details.added_date", "uuid": "e43a806f-d83d-45f3-abca-10194c8b5544", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-16T06:26:20.838Z", "date_only": false, "value": "2026-10-16T06:26:20.838669Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/serghei.bsky.social/post/3mxxwz2gj7s2e", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "2a96fd2a-1807-4f44-bc7a-14f6033a7e9a", "content": "BeyondTrust patched a Remote Support zero-day (CVE-2026-102764) exploited since August.\n\nMandiant attributes the attacks to Armory Castle (formerly UNC5221), a China-nexus espionage group that also hit Citrix and Ivanti appliances.\n\nBeyondTrust has 20,000+ customers, including 75% of Fortune 100.", "url": "https://bsky.app/profile/serghei.bsky.social/post/3mxxwz2gj7s2e"}, {"timestamp": "2026-10-16T06:30:00Z", "date_only": false, "value": "2026-10-16T06:30:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.se/2026/10/beyondtrust-varnar-for-kritisk-nolldagssarbarhet.html", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "6ba23be1-f6d9-46a4-b60b-807ad3a2ff22", "url": "https://www.cert.se/2026/10/beyondtrust-varnar-for-kritisk-nolldagssarbarhet.html"}, {"timestamp": "2026-10-16T06:40:39.439Z", "date_only": false, "value": "2026-10-16T06:40:39.439218Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxxxsnen5d22", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "baf6c78c-a33a-4126-a421-3153e5aa19ae", "content": "BeyondTrust Remote Support CVE-2026-102764 auth bypass has been exploited since August by a China-nexus actor. Self-hosted admins: apply the 8 Oct patch now. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxxxsnen5d22"}, {"timestamp": "2026-10-16T07:31:20.174Z", "date_only": false, "value": "2026-10-16T07:31:20.174588Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mxy2nb6xfs2v", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "a737e185-2a45-4217-8c43-5f643109a130", "content": "Chinese hackersgroep exploit kwetsbaarheid in BeyondTrust Remote Support softwar\n\nEind augustus 2026 werd een nuldaagse kwetsbaarheid, bekend als CVE-2026-102764, uitgebuit in BeyondTrust Remote Support appliances door een groep met vermeende banden met China, momenteel opererend onder de na...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3mxy2nb6xfs2v"}, {"timestamp": "2026-10-16T07:35:50.489Z", "date_only": false, "value": "2026-10-16T07:35:50.489773Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxy2vdgz6u2c", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "b1ad83d5-fd1d-4c99-8140-c15e5f2117ec", "content": "\ud83e\udd16 CVE-2026-102764 (CVSS 9.3): improper origin validation in BeyondTrust Remote Support. Exploited as a 0-day since late Aug 2026 by China-linked Armory Castle (UNC5221).\nhttps://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxy2vdgz6u2c"}, {"timestamp": "2026-10-16T07:43:15.587Z", "date_only": false, "value": "2026-10-16T07:43:15.587972Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mxy3clken52h", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "28334a7a-aabc-4a6b-b881-75c5c24d1b15", "content": "Armory Castle exploited a BeyondTrust Remote Support zero-day (CVE-2026-102764) to perform file operations, prompting patches for SaaS and self-hosted updates.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mxy3clken52h"}, {"timestamp": "2026-10-16T07:43:19.478Z", "date_only": false, "value": "2026-10-16T07:43:19.478635Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mxy3coau6e2b", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "bbcc3235-46ee-46ba-8afb-c30eccb60034", "content": "Armory Castle exploited a BeyondTrust Remote Support zero-day (CVE-2026-102764) to perform file operations, prompting patches for SaaS and self-hosted updates.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mxy3coau6e2b"}, {"timestamp": "2026-10-16T07:44:15.470Z", "date_only": false, "value": "2026-10-16T07:44:15.470364Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mxy3eesdby2t", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "cbd1a1bd-b5b8-473e-b6ef-3764ba68603c", "content": "Armory Castle exploited a BeyondTrust Remote Support zero-day (CVE-2026-102764) to perform file operations, prompting patches for SaaS and self-hosted updates.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mxy3eesdby2t"}, {"timestamp": "2026-10-16T07:52:29.545Z", "date_only": false, "value": "2026-10-16T07:52:29.545909Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxy3t3tsdl22", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "7ca018d5-ffb4-4168-aa17-c9eb401e4359", "content": "Patch CVE-2026-102764 now. This critical BeyondTrust Remote Support vulnerability is exploited in the wild as an ARMORY CASTLE zero-day.\n\n#BeyondTrust #CVE2026102764 #ZeroDay #ArmoryCastle #Mandiant #Cybersecurity #Vulnerability #InfoSec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mxy3t3tsdl22"}, {"timestamp": "2026-10-16T08:59:16.529Z", "date_only": false, "value": "2026-10-16T08:59:16.529160Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0437", "record": "NCSC-2026-0437", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-16T08:59:16.529Z", "date_only": false, "value": "2026-10-16T08:59:16.529160Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0437", "record": "NCSC-2026-0437", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-16T08:59:16.529Z", "date_only": false, "value": "2026-10-16T08:59:16.529160Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0437", "record": "NCSC-2026-0437", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-16T09:34:00Z", "date_only": false, "value": "2026-10-16T09:34:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "7e9d2c08-6555-41d1-bcd3-45e3f7ced258", "url": "https://cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764"}, {"timestamp": "2026-10-16T10:49:00.542Z", "date_only": false, "value": "2026-10-16T10:49:00.542488Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mxyfoqmesq2s", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "b024f66c-c21a-489b-a0f0-16f3ca34d4b1", "content": "On October 15, BeyondTrust disclosed CVE-2026-102764, a vulnerability in BeyondTrust Remote Support appliances allowing arbitrary file uploads. Mandiant reported that the ARMORY CASTLE threat actor exploited this zero-day in late August 2026, escalating privileges and establishing persistent access.", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mxyfoqmesq2s"}, {"timestamp": "2026-10-16T10:59:51.630Z", "date_only": false, "value": "2026-10-16T10:59:51.630837Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxygc5ol7f2q", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "e34f64de-e9c3-4e46-bf5a-c2c165ed03c5", "content": "\u30cf\u30c3\u30ab\u30fc\u3001BeyondTrust\u306e\u30bc\u30ed\u30c7\u30a4\u3092\u60aa\u7528\u3057\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ed\u30b0\u3092\u6d88\u53bb\u3057\u3066\u75d5\u8de1\u3092\u96a0\u853d\n\n\u4e2d\u56fd\u3068\u306e\u95a2\u9023\u304c\u7591\u308f\u308c\u308b\u30b9\u30d1\u30a4\u96c6\u56e3\u304c\u3001BeyondTrust Remote Support\u306e\u91cd\u5927\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\uff08CVE-2026-102764\uff09\u3092\u60aa\u7528\u3057\u307e\u3057\u305f\u3002\u3055\u3089\u306b\u3001\u30ed\u30b0\u3092\u524a\u9664\u3057\u3066\u6d3b\u52d5\u306e\u75d5\u8de1\u3092\u96a0\u3057\u3066\u3044\u307e\u3057\u305f\u3002 BeyondTrust\u306f\u3053\u306e\u8106\u5f31\u6027\u3092\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c9\u30d0\u30a4\u30b6\u30eaBT26-05\u3067\u4fee\u6b63\u3057\u30012026\u5e7410\u670815\u65e5", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxygc5ol7f2q"}, {"timestamp": "2026-10-16T11:13:37.389Z", "date_only": false, "value": "2026-10-16T11:13:37.389522Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mxyh2qr4fm2g", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "7a83fb5d-08a5-4688-b860-3c9e5ef9cfe6", "content": "A China-linked APT exploited CVE-2026-102764 in BeyondTrust Remote Support appliances as a zero-day, enabling file operations until patched across SaaS and self-hosted systems.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mxyh2qr4fm2g"}, {"timestamp": "2026-10-16T11:18:04.555Z", "date_only": false, "value": "2026-10-16T11:18:04.555227Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mxyhcp67um2k", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "88811e42-d661-48ba-bc4c-18e2cfb0815a", "content": "BeyondTrust\u306e\u8106\u5f31\u6027(CVE-2026-102764)\u304c\u4e2d\u56fdAPT\u306b\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u3055\u308c\u3001\u521d\u671f\u30a2\u30af\u30bb\u30b9\u3001\u30ab\u30b9\u30bf\u30e0\u30c4\u30fc\u30eb\u306e\u5c55\u958b\u3001\u30ed\u30b0\u524a\u9664\u306b\u60aa\u7528\u3055\u308c\u305f\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mxyhcp67um2k"}, {"timestamp": "2026-10-16T11:27:37Z", "date_only": false, "value": "2026-10-16T11:27:37.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/beyondtrust-security-advisory-av26-1054", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "aaf7672d-04a5-42eb-af7c-e364f34d069f", "url": "https://cyber.gc.ca/en/alerts-advisories/beyondtrust-security-advisory-av26-1054"}, {"timestamp": "2026-10-16T12:00:14.549Z", "date_only": false, "value": "2026-10-16T12:00:14.549806Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/windowsforum.com/post/3mxyjo46xyc24", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "331116eb-19ea-4b7a-b8f8-6af9add9ee6f", "content": "KB5127648 grays out Win11 Smart App Control; BeyondTrust Remote Support zero-day CVE-2026-102764; PowerToys 0.102.2883.0 adds ZoomIt offline dictation; stop Snipping Tool OneDrive saves; member help on Edge update schedules. +26 more stories, 5 member threads", "url": "https://bsky.app/profile/windowsforum.com/post/3mxyjo46xyc24"}, {"timestamp": "2026-10-16T12:00:27.391Z", "date_only": false, "value": "2026-10-16T12:00:27.391444Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxyjoifwuu26", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "ed668e83-67f4-4341-a6d3-38267250d61c", "content": "BeyondTrust says Armory Castle exploited CVE-2026-102764 on one self-hosted Remote Support appliance in August 2026. SaaS patches were applied by October 9; affected self-hosted customers should install the designated patch or upgrade.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxyjoifwuu26"}, {"timestamp": "2026-10-16T12:10:25.664Z", "date_only": false, "value": "2026-10-16T12:10:25.664602Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybergeodigest.bsky.social/post/3mxykadk5rh2x", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "2d9caa17-ef6b-411c-b5a9-e67e36ae4537", "content": "Today's CyberGeoDigest \u2014 20 stories\n\nTop: China's Armory Castle Exploits CVE-2026-102764 BeyondTrust Zero-Day\n\n#APT #ThreatIntel #CyberSecurity", "url": "https://bsky.app/profile/cybergeodigest.bsky.social/post/3mxykadk5rh2x"}, {"timestamp": "2026-10-16T13:18:08.753Z", "date_only": false, "value": "2026-10-16T13:18:08.753899Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jgreig.bsky.social/post/3mxynzewl6c2l", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "d7ec80a0-5dc7-42eb-9087-5113b9756e80", "content": "BeyondTrust blamed a Chinese espionage group known to exploit zero days in edge devices for recent attacks involving CVE-2026-102764\n\nThe vulnerability affects its Remote Support appliances that enable IT teams to securely access and troubleshoot remote endpoints\n\ntherecord.media/beyond-trust...", "url": "https://bsky.app/profile/jgreig.bsky.social/post/3mxynzewl6c2l"}, {"timestamp": "2026-10-16T13:59:28.493Z", "date_only": false, "value": "2026-10-16T13:59:28.493376Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117450943158768293", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "048cd6bb-4f3a-43a7-9797-67fd1f0265e1", "content": "\ud83d\udcf0 China-Linked Group Exploits BeyondTrust Zero-Day in Espionage Attacks\nA China-linked group, Armory Castle, is actively exploiting a critical zero-day (CVE-2026-102764) in BeyondTrust Remote Support appliances to gain root access and steal credentials. Patching is urgent. #CyberSecurity #ThreatIntel #ZeroDay #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/china-linked-hackers-exploit-beyondtrust-zero-day-in-espionage-campaign/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117450943158768293"}, {"timestamp": "2026-10-16T13:59:50.371Z", "date_only": false, "value": "2026-10-16T13:59:50.371395Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mxyqdxnsmr25", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "8eda1b36-aa15-4df8-b77e-f583e4a52ce1", "content": "A China-linked group, Armory Castle, is actively exploiting a critical zero-day (CVE-2026-102764) in BeyondTrust Remote Support appliances to gain root access and steal credentials. Patching is urgent. #CyberSecurity #ThreatIntel #ZeroDay #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mxyqdxnsmr25"}, {"timestamp": "2026-10-16T14:03:23.757Z", "date_only": false, "value": "2026-10-16T14:03:23.757246Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alphahunt.io/post/3mxyqkde2iw2t", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "42a989b5-f648-44c4-b236-66c3ef1b2fee", "content": "New report. Earlier intrusion.\n\nGoogle/Mandiant reports ARMORY CASTLE exploited CVE-2026-102764 as a zero-day in late August, escalated privileges and maintained appliance access. That does not establish an October wave.", "url": "https://bsky.app/profile/alphahunt.io/post/3mxyqkde2iw2t"}, {"timestamp": "2026-10-16T14:06:04.793Z", "date_only": false, "value": "2026-10-16T14:06:04.793943Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mxyqp4pxxn2n", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "24383c2c-d08d-4f91-b98a-388d06631053", "content": "BeyondTrust disclosed CVE-2026-102764, a CVSS 9.3 Remote Support flaw exploited as a zero-day since late August by China-linked Armory Castle, per The Hacker News. SaaS was patched October 9; self-hosted versions 24.3.1 through 26.2.3 need a manual update. thehackernews.com/2026/1...", "url": "https://bsky.app/profile/entorisec.bsky.social/post/3mxyqp4pxxn2n"}, {"timestamp": "2026-10-16T14:06:19.781Z", "date_only": false, "value": "2026-10-16T14:06:19.781344Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yasna.io/post/3mxyqpkzdjt2x", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "452e82d4-56cd-4019-9f58-6baf00484447", "content": "A suspected Chinese espionage group exploited a critical zero-day in BeyondTrust Remote Support software, enabling server takeover and long-term persistence.\n\nCVE-2026-102764 #ZeroDay #Flaw #infosec\n\nFull synthesis & sources: yasna.io", "url": "https://bsky.app/profile/yasna.io/post/3mxyqpkzdjt2x"}, {"timestamp": "2026-10-16T14:42:07.926Z", "date_only": false, "value": "2026-10-16T14:42:07.926102Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberupdates365.bsky.social/post/3mxysplh5e727", "record": "cve-2026-102764", "field": "creation_timestamp", "uuid": "574d5b05-5f9b-41a5-a367-9f4fd5507c51", "content": "China-Linked Hackers Exploit BeyondTrust Zero-Day to Hijack Remote Support Servers\n\nhttps://cyberupdates365.com/beyondtrust-zero-day-cve-2026-102764/\n\n#CyberSecurity", "url": "https://bsky.app/profile/cyberupdates365.bsky.social/post/3mxysplh5e727"}, {"timestamp": "2026-10-16T15:25:41.582Z", "date_only": false, "value": "2026-10-16T15:25:41.582852Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/117451282188967869", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "0d3d4c43-5870-4467-b328-91e597caf11f", "content": "\ud83d\udea8 Some increased actor activities are shown targeting BeyondTrust Remote Support (CVE-2026-102764) https://vuldb.com/vuln/420894/cti", "url": "https://infosec.exchange/users/vuldb/statuses/117451282188967869"}, {"timestamp": "2026-10-16T15:44:24.074Z", "date_only": false, "value": "2026-10-16T15:44:24.074193Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxyw6x5bj62g", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "5e15a747-feeb-4350-9d2e-bc380ca1cc45", "content": "\ud83e\udd16 CVE-2026-102764 (CVSS 9.3): China-nexus group Armory Castle (ex-UNC5221) exploited an improper origin validation flaw in BeyondTrust Remote Support as a zero-day to seize remote support servers.\nhttps://thehackernews.com/2026/10/china-linked-hackers-exploited.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxyw6x5bj62g"}, {"timestamp": "2026-10-16T16:12:29.171Z", "date_only": false, "value": "2026-10-16T16:12:29.171272Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxyxr5jlcu2r", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "13107cb4-cc76-465c-a463-8f7e037041ec", "content": "Mandiant and Google GTIG say China-linked Armory Castle exploited CVE-2026-102764 in BeyondTrust Remote Support from August, using webshells and a tunneler. BeyondTrust patched affected versions; SaaS customers have been updated, while some self-hosted users must patch.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxyxr5jlcu2r"}, {"timestamp": "2026-10-16T16:21:52.997Z", "date_only": false, "value": "2026-10-16T16:21:52.997691Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trustlist.bsky.social/post/3mxyybxjb4i27", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "ec885224-e19c-473f-876b-eac75b2e9837", "content": "BeyondTrust Remote Support flaw exploited as a zero-day since August\n\nCVE-2026-102764 scores 9.3 and affects Remote Support 26.2.3 and earlier. Mandiant traced exploitation to late August.\n\n#infosec #cybersecurity #VulnerabilityManagement\ntrustlist.uk/security-advisorie\u2026", "url": "https://bsky.app/profile/trustlist.bsky.social/post/3mxyybxjb4i27"}, {"timestamp": "2026-10-16T17:45:05.800Z", "date_only": false, "value": "2026-10-16T17:45:05.800898Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/techupscale.com/post/3mxz4wqzr672l", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "25b260f4-2a9a-416e-a90a-9b9632d765d8", "content": "\ud83d\udea8 BREAKING: BeyondTrust Remote Support flaw CVE-2026-102764 is being actively exploited, CISA warns\n\nCVE-2026-102764  \u00b7  CVSS 9.3 Critical  \u00b7  US federal deadline October 19, 2026  \u00b7  CISA KEV\n\n#cybersecurity #vulnerability", "url": "https://bsky.app/profile/techupscale.com/post/3mxz4wqzr672l"}, {"timestamp": "2026-10-16T18:00:01Z", "date_only": false, "value": "2026-10-16T18:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-102764", "field": "timestamps.recorded_at", "uuid": "a78314a4-fcef-4227-9854-abe2f272b931", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-16T18:00:02.843Z", "date_only": false, "value": "2026-10-16T18:00:02.843988Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a78314a4-fcef-4227-9854-abe2f272b931", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "c93a6d8d-23f5-4722-a8ab-76bfc7d46183", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a78314a4-fcef-4227-9854-abe2f272b931"}, {"timestamp": "2026-10-16T18:15:03.572Z", "date_only": false, "value": "2026-10-16T18:15:03.572036Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxz6mcnzis2l", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "79069b1b-7ba5-4620-aec9-72d9f2d2825e", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-99999 \u00b7 43 people\n2. CVE-2026-102764 \u00b7 27 people \ud83d\udd25\n3. CVE-2026-0322 \u00b7 13 people \ud83d\udd25\n4. CVE-2026-76519 \u00b7 11 people \ud83d\udd25\n5. CVE-2026-110447 \u00b7 10 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxz6mcnzis2l"}, {"timestamp": "2026-10-16T18:15:04.495Z", "date_only": false, "value": "2026-10-16T18:15:04.495995Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxz6mct6k22l", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "080028ca-70b4-4e62-beb7-eff1f2bcbd7d", "content": "2. CVE-2026-102764 \u00b7 27 people \ud83d\udd25\n\ud83d\udfe5 Critical 9.3 \u00b7 BeyondTrust Remote Support\n\nImproper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxz6mct6k22l"}, {"timestamp": "2026-10-16T18:20:03.665Z", "date_only": false, "value": "2026-10-16T18:20:03.665734Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mxz6vb4wzb2r", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "cfa2140d-25bb-4462-ba3b-9252d4c5a645", "content": "CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities list (2026-10-16).\nBeyondTrust Remote Support Authentication Bypass by Spoofing\nEPSS today: 0.006 (no score 30 days earlier)\n#infosec #KEV", "url": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mxz6vb4wzb2r"}, {"timestamp": "2026-10-16T18:33:53.749Z", "date_only": false, "value": "2026-10-16T18:33:53.749950Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mxz7nzox3k2i", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "38b55e48-5e85-4ffb-8ac6-2e71b9f1f0d3", "content": "\ud83d\uded1 CVE-2026-102764\nBeyondTrust Remote Support\nCVSS 9.3 / EPSS 1% / KEV: No\nTL;DR: The vulnerability exists within internal components of BeyondTrust\u2019s Remote Su\u2026\nhttps://cvesentinel.com/report/CVE-2026-102764?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mxz7nzox3k2i"}, {"timestamp": "2026-10-16T19:23:17.868Z", "date_only": false, "value": "2026-10-16T19:23:17.868509Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/censys.bsky.social/post/3mxzcgdpoqs2m", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "3886547d-602c-4bc2-9215-0b2537d4e3b9", "content": "\ud83d\udea8 Rapid Response | BeyondTrust Remote Support/Privileged Remote Access Zero-Day (CVE-2026-102764) (CVSS 9.3) critical vulnerability. \n\nCensys detects 9,569 exposed hosts & 177,497 web properties running Remote Support or Privileged Remote Access, not all confirmed vulnerable. https://bit.ly/4ymlmeh ", "url": "https://bsky.app/profile/censys.bsky.social/post/3mxzcgdpoqs2m"}, {"timestamp": "2026-10-16T20:01:09.120Z", "date_only": false, "value": "2026-10-16T20:01:09.120490Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxzek2dsne2e", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "4477a13c-2cf5-44da-9fb0-639f36152c7a", "content": "~Cisa~\nCISA added Fortinet path traversal and BeyondTrust authentication bypass flaws to its KEV Catalog; prioritize remediation.\n-\nIOCs: CVE-2025-61624, CVE-2026-102764\n-\n#CVE #KEV #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mxzek2dsne2e"}, {"timestamp": "2026-10-16T20:15:04.352Z", "date_only": false, "value": "2026-10-16T20:15:04.352815Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mxzfcwthba22", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "a6f72811-a6fd-4aa1-b21c-47c62a64b1cf", "content": "\ud83d\udea8 NEW on CISA KEV \u2014 exploited in the wild\nBeyondTrust Remote Support: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability\nCVE-2026-102764 \u00b7 patch by 2026-10-19\n\ud83d\udd17 https://ninjasignal.ninja/intel/cve/CVE-2026-102764\n#KEV #cybersecurity #infosec", "url": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mxzfcwthba22"}, {"timestamp": "2026-10-16T21:32:45Z", "date_only": false, "value": "2026-10-16T21:32:45Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-PF95-V8M2-73Q8", "record": "GHSA-PF95-V8M2-73Q8", "field": "modified"}, {"timestamp": "2026-10-16T22:02:12.856Z", "date_only": false, "value": "2026-10-16T22:02:12.856674Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mxzlcjmq3n2j", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "7ba812d9-964c-48f7-bf0d-4158f1727cda", "content": "\ud83d\udcf0 CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support\n\nCISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (f...\n\nhttps://tinyurl.com/2xs7zc9y #TechNews #CrustyTLDR", "url": "https://bsky.app/profile/crustytldr.bsky.social/post/3mxzlcjmq3n2j"}, {"timestamp": "2026-10-17T01:16:59.657Z", "date_only": false, "value": "2026-10-17T01:16:59.657000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "522a2b96-358a-4bdd-a368-b9c01af9a694", "url": "https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust"}, {"timestamp": "2026-10-17T02:07:07.421Z", "date_only": false, "value": "2026-10-17T02:07:07.421622Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mxzyyhismd2r", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "c3f76ead-08f1-434b-a035-1389f3a32680", "content": "\ud83d\udccc CVE-2026-102764 - The vulnerability exists within internal components of BeyondTrust\u2019s Remote Support product. The components did not adequately validate the origin of ... https://www.cyberhub.blog/cves/CVE-2026-102764", "url": "https://bsky.app/profile/cyberhub.blog/post/3mxzyyhismd2r"}, {"timestamp": "2026-10-17T02:30:34.364Z", "date_only": false, "value": "2026-10-17T02:30:34.364208Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/johnwlittle.com/post/3my22asqgcaj7", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "00abbb0d-6d2c-4f3e-bcb4-cf8b1c8aa6db", "content": "CISA added BeyondTrust Remote Support flaw CVE-2026-102764 to its exploited-vulnerability catalog Oct. 16. BeyondTrust says SaaS instances are patched; self-hosted customers should check BT26-05.\nhttps://www.beyondtrust.com/trust-center/security-advisories/bt26-05", "url": "https://bsky.app/profile/johnwlittle.com/post/3my22asqgcaj7"}, {"timestamp": "2026-10-17T03:55:27.214Z", "date_only": false, "value": "2026-10-17T03:55:27.214Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-102764", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-17T03:55:27.214Z", "date_only": false, "value": "2026-10-17T03:55:27.214Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-102764", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-17T04:01:11.408Z", "date_only": false, "value": "2026-10-17T04:01:11.408954Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3my27efonoc2v", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "6458e740-ed81-49bb-80ff-dcd2680ea271", "content": "~Cisa~\nAttackers exploit an authentication bypass in self-hosted BeyondTrust Remote Support; patch immediately.\n-\nIOCs: CVE-2026-102764\n-\n#BeyondTrust #CVE2026102764 #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3my27efonoc2v"}, {"timestamp": "2026-10-17T04:16:47.117Z", "date_only": false, "value": "2026-10-17T04:16:47.117", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102764", "record": "FKIE_CVE-2026-102764", "field": "lastModified"}, {"timestamp": "2026-10-17T05:00:08.156Z", "date_only": false, "value": "2026-10-17T05:00:08.156081Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinity.sh/post/3my2cntjaop2c", "record": "cve-2026-102764", "field": "creation_timestamp", "uuid": "fb0c6a2b-f362-4bea-8c54-4f8b785ca7fc", "content": "CVE-2026-102764: ARMORY CASTLE exploited a BeyondTrust Remote Support zero-day, dropping SAWFLY webshell and BARECLAW SOCKS5 tunneler. Custom malware, HAProxy backdoor, log wiping. CVSS 9.3. Exploited since August.\nhttps://trinity.sh/posts/2026-10-17-cve-2026-102764-beyondtrust-zero-day/", "url": "https://bsky.app/profile/trinity.sh/post/3my2cntjaop2c"}, {"timestamp": "2026-10-17T06:01:21.876Z", "date_only": false, "value": "2026-10-17T06:01:21.876309Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/raven-sec.bsky.social/post/3my2g37r5qdtm", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "7b96d88b-0dac-4445-acfb-ab506a274569", "content": "BeyondTrust CVE-2026-102764 actively exploited\u2014patch now\n\n\u2022 BlockStrap RCE on Magento/Commerce (08936e4)\n\u2022 LearnPress CVSS 9.8 PHP injection flaw (CVE-2026-104736)\n\n4 sources verified \u00b7 hackingallthethings.com\n#infosec #threatintel #cybersecurity #Vulnerability #BeyondTrust", "url": "https://bsky.app/profile/raven-sec.bsky.social/post/3my2g37r5qdtm"}, {"timestamp": "2026-10-17T06:03:32.154Z", "date_only": false, "value": "2026-10-17T06:03:32.154728Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3my2g76yiyr2e", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "1936170a-9993-4f1d-a3b5-a5d3d034d437", "content": "\ud83e\udd16 CVE-2026-102764 (CVSS 9.3): China-nexus APT \"Armory Castle\" exploited a BeyondTrust Remote Support 0-day. Webshell SAWFLY deployed 11 min later; appliance secrets vault dumped. CISA KEV Oct 16.\nhttps://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3my2g76yiyr2e"}, {"timestamp": "2026-10-17T06:05:49.051Z", "date_only": false, "value": "2026-10-17T06:05:49.051989Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3my2gdbnb2h2p", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "0648cab6-4e70-4adc-af43-9671a2932549", "content": "Top 3 CVE for last 7 days:\nCVE-2026-94603: 148 interactions\nCVE-2026-99999: 89 interactions\nCVE-2026-92392: 67 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-94603: 148 interactions\nCVE-2026-99999: 74 interactions\nCVE-2026-102764: 38 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3my2gdbnb2h2p"}, {"timestamp": "2026-10-17T06:36:26.858Z", "date_only": false, "value": "2026-10-17T06:36:26.858195Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3my2hzzqnm22y", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "3faa8926-be72-49ef-bf76-037d13f20f8c", "content": "BeyondTrust says suspected China-linked actor ARMORY CASTLE exploited CVE-2026-102764 in Remote Support appliances. The article details the attack and recommends patching affected self-hosted systems and investigating appliances exposed while vulnerable.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3my2hzzqnm22y"}, {"timestamp": "2026-10-17T06:50:59.077Z", "date_only": false, "value": "2026-10-17T06:50:59.077299Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3my2itzwv3i2w", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "4563f8b4-80e8-4ed9-88ef-d7ff18d397cd", "content": "\ud83d\udd34 Exploitation confirm\u00e9e (CISA KEV, ajouts du 16/10) \u00b7 2\n\u2022 Fortinet Multiple Products CVE-2025-61624, CVSS 6.5\n\u2022 BeyondTrust Remote Support CVE-2026-102764, CVSS 9.3", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3my2itzwv3i2w"}, {"timestamp": "2026-10-17T07:00:01Z", "date_only": false, "value": "2026-10-17T07:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-102764", "field": "timestamps.recorded_at", "uuid": "e43a806f-d83d-45f3-abca-10194c8b5544", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-17T07:00:40.409Z", "date_only": false, "value": "2026-10-17T07:00:40.409000Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e43a806f-d83d-45f3-abca-10194c8b5544", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "3b1c78aa-511d-4b97-aa06-fdab92c57e51", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e43a806f-d83d-45f3-abca-10194c8b5544"}, {"timestamp": "2026-10-17T07:24:40.150Z", "date_only": false, "value": "2026-10-17T07:24:40.150446Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3my2kqam3t2by", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "8d1a8fb6-798b-4f1d-95fc-8908d016ac12", "content": "Incident Radar | ARMORY CASTLE Exploited BeyondTrust Remote Support Zero-Day\n\nMandiant identified evidence that ARMORY CASTLE exploited CVE-2026-102764 in BeyondTrust Remote Support appliances as a zero-day\u2026\n\nSource: Google Threat Intelligence\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1284", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3my2kqam3t2by"}, {"timestamp": "2026-10-17T08:28:51.351Z", "date_only": false, "value": "2026-10-17T08:28:51.351871Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3my2oczvz2i2z", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "6a0ff89d-425c-4f94-9dbc-a4ec472256d6", "content": "China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns\n\nThis article overemphasizes the \"deep understanding\" required for exploitation by treating CVE-2026-102764 as a singular enabling vulnerability. If persistence was achieved via file system m\u2026\n\nvia InfoSecurity Magazine", "url": "https://bsky.app/profile/arc-codex.com/post/3my2oczvz2i2z"}, {"timestamp": "2026-10-17T09:28:32.165Z", "date_only": false, "value": "2026-10-17T09:28:32.165492Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3my2rnrf7ga25", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "ec24a3dc-e2e2-4709-8431-f9d794a3a48c", "content": "CVE-2026-102764 is trending. Hype score 9, currently #6 on cvemon.\n\nThe vulnerability exists within internal components of BeyondTrust\u2019s Remote Support product. The components did not adequately validate the origin of the messages it received. Under\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-102764", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3my2rnrf7ga25"}, {"timestamp": "2026-10-17T17:12:53.079Z", "date_only": false, "value": "2026-10-17T17:12:53.079849Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3my3lm352u727", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "dd9f75ff-a81d-4943-baf8-b77802af0112", "content": "A China-linked group, Armory Castle, is actively exploiting a critical zero-day (CVE-2026-102764) in BeyondTrust Remote Support appliances to gain root access and steal credentials. Patching is urgent. #CyberSecurity #ThreatIntel #ZeroDay #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3my3lm352u727"}, {"timestamp": "2026-10-17T18:22:41.992Z", "date_only": false, "value": "2026-10-17T18:22:41.992497Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my3p3nq27k2x", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "d4b17211-82d8-485f-ae29-87039315cbf3", "content": "2. CVE-2026-102764 \u00b7 20 people \ud83d\udd25\n\ud83d\udfe5 Critical 9.3 \u00b7 BeyondTrust Remote Support\n\nImproper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my3p3nq27k2x"}, {"timestamp": "2026-10-17T21:51:09.956Z", "date_only": false, "value": "2026-10-17T21:51:09.956446Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3my435ohiwl2j", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "56b61728-fd1a-4225-abaa-fd4ac345f728", "content": "The Circuitry Daily Rundown: Oct 17\n\n\u2022 Apple Expands App Store Rules to Block AI Deepfakes\n\u2022 BeyondTrust Remote Support Zero-Day CVE-2026-102764 Hit in August\u2026\n\u2022 CISA adds two actively exploited AhsayCBS flaws to KEV catalog\n\nVerified, in about a minute.", "url": "https://bsky.app/profile/thecircuitry.to/post/3my435ohiwl2j"}, {"timestamp": "2026-10-18T18:15:30.034Z", "date_only": false, "value": "2026-10-18T18:15:30.034657Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my67kxznoc2g", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "dba04f11-7473-4a9a-8ac5-27ed99f7caeb", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-99999 \u00b7 21 people\n2. CVE-2026-102764 \u00b7 4 people \ud83d\udd25\n3. CVE-2026-109894 \u00b7 4 people\n4. CVE-2026-111998 \u00b7 4 people\n5. CVE-2026-112005 \u00b7 4 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my67kxznoc2g"}, {"timestamp": "2026-10-18T18:15:30.046Z", "date_only": false, "value": "2026-10-18T18:15:30.046207Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my67kxznoc2g", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "8d956721-d1c1-4143-9fe4-31f504248692", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-99999 \u00b7 21 people\n2. CVE-2026-102764 \u00b7 4 people \ud83d\udd25\n3. CVE-2026-109894 \u00b7 4 people\n4. CVE-2026-111998 \u00b7 4 people\n5. CVE-2026-112005 \u00b7 4 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my67kxznoc2g"}, {"timestamp": "2026-10-18T18:15:31.016Z", "date_only": false, "value": "2026-10-18T18:15:31.016034Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my67kyczi22g", "record": "CVE-2026-102764", "field": "creation_timestamp", "uuid": "70915368-0d7d-4147-af5c-07e18340b235", "content": "2. CVE-2026-102764 \u00b7 4 people \ud83d\udd25\n\ud83d\udfe5 Critical 9.3 \u00b7 BeyondTrust Remote Support\n\nImproper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my67kyczi22g"}, {"timestamp": "2026-10-19T00:00:00Z", "date_only": true, "value": "2026-10-19", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-102764", "field": "evidence.0.details.due_date", "uuid": "a78314a4-fcef-4227-9854-abe2f272b931", "status": {"status_reason": "confirmed", "exploited": true}}]}