VulnRadar

Data against noise.

Built with NaN
Page generated: 06 Nov 2026, 03:49 UTC
← Dashboard

CVE-2026-102764

RefluXFS

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

CVSS 9.3 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
8.8/10
REALITY · THREAT PRIORITY
8.8/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.3: +1.40
  • Fresh EPSS: 77.99%: +0.39

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 39 documents and public datasets.

Hype components

Headline sample (25%)
50/100
Press, 30 days (60%)
100/100
Grounded branding (15%)
100/100
HYPE TOTAL88/100

Sources and documents

Rapid7 Cybersecurity Blog
Press · 30 Oct 2026, 16:01 · Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)
shattered.io
Press · 22 Oct 2026, 07:00 · BeyondTrust Zero-Day CVE-2026-102764: China APT, CVSS 9.3 - shattered.io
Howl.link
Press · 21 Oct 2026, 07:00 · Weekly Security Roundup: PHP and Node.js Patches, OpenCode Breach, and More · cyber.hendryadrian.com - Howl.link
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 20 Oct 2026, 07:00 · BeyondTrust Remote Support Security Restriction Bypass Vulnerability - Hong Kong Computer Emergency Response Team Coordination Centre
Forkast News
Press · 20 Oct 2026, 07:00 · BeyondTrust Remote Support Ships Internal Messaging That Can Be Spoofed. ARMORY CASTLE Exploited It in August. - Forkast News
See all 39 source documents
Rapid7 Cybersecurity Blog
Press · 19 Oct 2026, 14:34 · CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild
Rapid7
Press · 19 Oct 2026, 07:00 · CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild - Rapid7
"CVE-2026-102764" - Google News
Press · 17 Oct 2026, 07:00 · U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulne... - Security Affairs
https://tech-insider.org/
Press · 17 Oct 2026, 07:00 · BeyondTrust Zero-Day CVE-2026-102764 Explained [2026] - https://tech-insider.org/
Rescana
Press · 17 Oct 2026, 07:00 · BeyondTrust Remote Support CVE-2026-102764: Zero-Day Exploited Since August, Now in CISA KEV - Rescana
Dark Reading
Press · 16 Oct 2026, 20:57 · BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs - Dark Reading
SecNews.gr
Press · 16 Oct 2026, 10:36 · Chinese hackers exploited BeyondTrust Remote Support zero-day - SecNews.gr
The Hacker News
Press · 16 Oct 2026, 07:00 · China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers - The Hacker News
cyberkendra.com
Press · 16 Oct 2026, 07:00 · CVE-2026-102764: BeyondTrust Zero-Day Exploited in Attacks - cyberkendra.com
SOC Prime
Press · 16 Oct 2026, 07:00 · CVE-2026-102764: Critical BeyondTrust Remote Support Zero-Day Exploited by China-Linked Hackers - SOC Prime
BleepingComputer
Press · 16 Oct 2026, 07:00 · BeyondTrust patches zero-day exploited in attacks since August - BleepingComputer
CCB Belgium
Press · 16 Oct 2026, 07:00 · Warning: Critical Vulnerability in BeyondTrust Remote Support, Patch Immediately! - CCB Belgium
SecurityWeek
Press · 16 Oct 2026, 07:00 · Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day - SecurityWeek
Cybersecurity Dive
Press · 16 Oct 2026, 07:00 · China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign - Cybersecurity Dive
SOCRadar
Press · 16 Oct 2026, 07:00 · CVE-2026-102764: BeyondTrust Zero-Day Exploited - SOCRadar
Cyber Press
Press · 16 Oct 2026, 05:51 · Hackers Exploit BeyondTrust Zero-Day to Establish Persistent Root Access and Target Credentials - Cyber Press
Threat Intelligence
Press · 15 Oct 2026, 14:00 · ARMORY CASTLE Exploits BeyondTrust
Google Cloud
Press · 15 Oct 2026, 07:00 · ARMORY CASTLE Exploits BeyondTrust - Google Cloud
watchTowr
Press · 07 Oct 2026, 07:00 · Post-Exploitation Analysis & Artifacts – Citrix NetScaler CVE-2026-88771 - watchTowr
watchTowr
Press · 10 Sep 2026, 07:00 · Rapid Reaction: GitLab Path Traversal Vulnerability (CVE-2026-85706) - watchTowr
forkast.news
Press · 31 Jul 2026, 07:00 · RefluXFS: A Nine-Year-Old Linux Kernel Bug Found by AI in Weeks Affects 16.4 Million Systems - forkast.news
SOC Prime
Press · 30 Jul 2026, 07:00 · CVE-2026-20316: Cisco FMC Zero-Day Exploited - SOC Prime
Rapid7
Press · 29 Jul 2026, 07:00 · CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCity - Rapid7
Intelligent CISO
Press · 27 Jul 2026, 07:00 · Qualys identifies Linux kernel vulnerability affecting millions of systems - Intelligent CISO
Network World
Press · 23 Jul 2026, 07:00 · Linux XFS has a decade-old race condition allowing full root access - Network World
BleepingComputer
Press · 23 Jul 2026, 07:00 · New RefluXFS Linux flaw lets attackers gain root privileges - BleepingComputer
SecurityBrief Australia
Press · 23 Jul 2026, 07:00 · Linux kernel flaw lets local users gain root access - SecurityBrief Australia
The Hacker News
Press · 23 Jul 2026, 07:00 · Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs - The Hacker News
Tech Times
Press · 23 Jul 2026, 07:00 · Linux Kernel Flaw Exposes 16 Million RHEL Systems to Silent Root Takeover - Tech Times
SOC Prime
Press · 23 Jul 2026, 07:00 · CVE-2026-64600: RefluXFS Linux Kernel Flaw Can Lead to Root Privilege Escalation - SOC Prime
SOC Prime
Press · 23 Jul 2026, 07:00 · CVE-2026-14266: 7-Zip Heap Overflow Flaw Can Lead to Remote Code Execution - SOC Prime
Qualys
Press · 22 Jul 2026, 07:00 · RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600) - Qualys
CyberSecurityNews
Press · 22 Jul 2026, 07:00 · RefluXFS Linux Kernel Vulnerability Lets Attackers Gain Root Access - CyberSecurityNews
shattered.io
Press · 13 Oct 2016, 07:00 · Ivanti, BeyondTrust Zero-Days: KEV Oct. 13 and 16 [2026] - shattered.io

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

024681002 Nov 2026 · HIGH ATTENTION + OBSERVED EXPLOITATIONHype 8.8Reality 8.504 Nov 2026 · HIGH ATTENTION + OBSERVED EXPLOITATIONHype 8.8Reality 8.8Nov 2Nov 4

━ Hype Score (Perceived)  ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.3; EPSS 78.0%
Attention, last 30 days
24 distinct story titles; 24 press documents; 3 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:49.837387+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Primary reports used by this score

  • Google Threat Intelligence

    Automatic extraction found a source statement about exploitation in attacks naming CVE-2026-102764.

    Following the successful exploitation of CVE-2026-102764, Mandiant observed ARMORY CASTLE leverage multiple distinct TTPs to establish a foothold, escalate privileges, and enable lateral movement. Throughout

    Scope: Only the cited paragraph and its stated conditions; not a prevalence estimate.

    Attack observation: not dated; automatic extraction: primary-assertions-v1; not independently reviewed.

Source event timeline
First press mention
13 Oct 2016, 07:00
Published
15 Oct 2026, 20:30
Added to the CISA KEV catalog
16 Oct 2026, 00:00
Latest press mention
30 Oct 2026, 16:01
Score calculated
05 Nov 2026, 13:59
Name
RefluXFS
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar