VULNpocalypse
Breaches and incidentsBriefChecked against a primary source

ARMORY CASTLE / Warp Panda (formerly UNC5221): BeyondTrust Remote Support zero-day and VMware ESX logging zero-day

Google GTIG / Mandiant (16 Oct): CVE-2026-102764, an unauthenticated arbitrary file upload in BeyondTrust Remote Support up to 26.2.3, exploited as a...

Disclosed

What happened

  • Google GTIG / Mandiant (16 Oct): CVE-2026-102764, an unauthenticated arbitrary file upload in BeyondTrust Remote Support up to 26.2.3, exploited as a zero-day from late August 2026. BeyondTrust patched (BT26-05) on 8 Oct, SaaS tenants by 9 Oct, disclosed 15 Oct.
  • Techniques (GTIG): SAWFLY PHP webshell (mangoapi.php), SUID copy of /bin/sh as /usr/bin/dbus-authd, credential dump via the native bt-secrets CLI, NOPASSWD sudoers persistence surviving reboot, BARECLAW SOCKS5-over-WebSocket tunnel exposed through an edited haproxy.conf, heavy log deletion.
  • Separately (THN, 29 Oct, citing CrowdStrike): Warp Panda exploited VMware ESX CVE-2026-41709 (insufficient logging, CVSS 2.7, fixed July 2026, CISA KEV 28 Oct) in early 2026 to hide admin actions, mainly against the US legal sector, alongside BRICKSTORM on vCenter.
  • Attribution: GTIG calls ARMORY CASTLE a suspected PRC-nexus espionage actor. THN reports CrowdStrike’s Warp Panda name and lists ARMORY CASTLE / UNC5221 as aliases; the alias mapping is THN’s, not checked against CrowdStrike’s report.

Live scores

Live scores

CVE-2026-41709
EPSS
0.007
low predicted chance of attack
VEDAS
0.513
some exploit evidence
On CISA KEV
Yes, since 2026-10-28
Detection rule
None yet
EPSS (chance of attack)
100.1Added to CISA KEV 2026-10-28CVE-2026-41709 EPSS over time2026-082026-11-01
VEDAS (exploit evidence)
100.9Added to CISA KEV 2026-10-28CVE-2026-41709 VEDAS over time2026-082026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

Live scores

CVE-2026-102764
EPSS
0.190
likely to be attacked soon
VEDAS
0.555
some exploit evidence
On CISA KEV
Yes, since 2026-10-16
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-102764 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-102764 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Sources

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.