beyondtrust

BeyondTrust Remote Support zero-day exploited by Chinese spies

CVE-2026-102764 let ARMORY CASTLE root self-hosted BeyondTrust appliances, dump credential vaults and survive reboots. CISA's deadline is tomorrow.