Vendor hub
Unauthenticated file operations on BeyondTrust Remote Support up to 26.2.3, exploited since 2026-08 by suspected PRC-nexus actor ARMORY CASTLE.
Updated 2026-11-11
| CVE | Product | Added to KEV | Status | Dossier |
|---|---|---|---|---|
| CVE-2026-102764 | BeyondTrust Remote Support | 2026-10-16 | Active exploitation | Read → |
| CVE-2026-1731 | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) | 2026-02-13 | Active exploitation | Planned |
| CVE-2024-12686 | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) | 2025-01-13 | Active exploitation | Planned |
| CVE-2024-12356 | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) | 2024-12-19 | Active exploitation | Planned |