Friday, October 16, 2026 — weekly wrap-up: China-linked Armory Castle rooted BeyondTrust Remote Support as a zero-day months before disclosure, Cisco Secure Email Gateways are still being rooted by crafted attachments with a Saturday federal patch deadline, and Ivanti Connect Secure still lacks a fix for the privilege-escalation leg of a three-bug root chain.

Mandiant attributes late-August zero-day exploitation of BeyondTrust Remote Support to Armory Castle (formerly UNC5221). CVE-2026-102764 (CVSS 9.3) is improper origin validation in an internal messaging component that lets a remote attacker perform file operations on the appliance. SaaS was patched October 9; self-hosted 24.3.1–26.2.3 need BT26-05-RS manually. Post-exploit tooling included SAWFLY (PHP web shell) and BARECLAW (SOCKS5 tunnel). Internet-facing appliances that were vulnerable during the window should be treated as compromised until reviewed.

CVE: CVE-2026-102764 (CVSS 9.3, exploited as zero-day)

Before the weekend: apply BT26-05-RS (or upgrade below 24.3.1), hunt for SAWFLY, dbus-authd, and BARECLAW, then rotate every credential the appliance stored or brokered.

Sources: The Hacker News, Google / Mandiant, BeyondTrust BT26-05

CVE-2026-76519 (CVSS 9.8) in Secure Email Gateway lets an unauthenticated sender write files and run root commands via a crafted attachment when File Reputation (AMP) is enabled and Content Scanner Tools is older than 25.3.0.5525. The fix shipped September 14; active exploitation was confirmed this week. CISA listed it on KEV with a Saturday federal deadline. A clean compromise check is not proof of safety after root access.

CVE: CVE-2026-76519 (CVSS 9.8, exploited)

Before the weekend: confirm Content Scanner Tools 25.3.0.5525 or later on every gateway, run grep "System Security" system_logs on every cluster member, and treat a clean result as inconclusive if the box was exposed.

Source: The Hacker News

Volexity found UTA0576 chaining three zero-days against a fully patched Connect Secure appliance starting October 3. Auth bypass and RCE are tracked as CVE-2026-104935 and are fixed in 22.8R2.5 / 25.1.3; the privilege-escalation leg remains unpatched. Ivanti's Integrity Checker Tool misses the in-memory chain. Attackers stole stored LDAP credentials and password-sprayed Active Directory.

CVE: CVE-2026-104935 (auth bypass + RCE, exploited); privilege escalation still unpatched

Before the weekend: upgrade to 22.8R2.5 or 25.1.3, hunt for floods of welcome.cgi requests with an X-DSCGI-Path header, rotate every credential stored on the box, and watch for the third patch.

Sources: Volexity, CISA

More from Matt: https://www.mattchapman.net

Kindle: https://www.amazon.com/dp/B0HHMH88H9
Apple Books: https://books.apple.com/us/book/local-ai-on-the-mac/id6807243472

Barnes & Noble: https://www.barnesandnoble.com/w/books/1151622292?ean=2940185390764

https://mattch

Support the show