BeyondTrust has patched a critical zero-day vulnerability (CVE-2026-102764) in its Remote Support (RS) product, which has been actively exploited since late August by the China-nexus cyber espionage group Armory Castle. The flaw is an improper origin validation bug in an internal messaging component, allowing attackers to take over remote support servers. This incident follows a trend of exploited edge device vulnerabilities, emphasizing the need for rapid patching.