The emergency patch is a milestone. It is not the end of the CVE-2026-102764 response. Once a BeyondTrust Remote Support service is patched or rebuilt, the team still has to prove that the replacement behaves as intended, that external exposure matches the approved service model and that the supporting evidence remains available.
BeyondTrust says Remote Support versions through 26.2.3 were affected, SaaS customers were patched automatically and self-hosted customers need the BT26-05-RS patch. Mandiant recommends a patch-first approach but also documents host-level persistence, credential access, altered application permissions and log deletion. Those findings make post-change monitoring part of the recovery, not an optional follow-up.
Verify the new baseline
Record the build and patch state after the change. Confirm the expected /appliance and /login interfaces, the support services and the listening paths. Compare the new installation with the approved build and configuration baseline. A device can be patched and still expose an unintended path if the configuration was copied from a compromised system.
Start with a clean inventory of local administrators, API accounts, security providers, outbound event destinations and syslog targets. Check Jump Item and team roles against the pre-incident baseline. Default roles should not grant broad access merely because a previous administrator needed it during an incident.
If the appliance was rebuilt, validate certificate and enrollment state before reconnecting users. Reissue the TLS certificate where required and redeploy Jump Clients, Jumpoints and the representative console from the trusted appliance. Do not restore old enrollment tokens merely to shorten the outage.
Keep evidence outside the host
Forward syslog to a separate collector over an encrypted channel. Retain reverse-proxy or WAF logs, perimeter firewall records and identity-provider events for the appliance. A local log is convenient but can disappear with a privileged attacker. The external copy establishes reachability, authentication and request history even when the host record is incomplete.
Monitor for gaps. A break in the appliance's log flow can indicate a network problem, a configuration error or deliberate anti-forensics. Alert when the gap overlaps with an administrative session, a file transfer or a new external request path. Maintain a timestamp source so alerting can correlate the appliance with the proxy and firewall.
Watch configuration drift
A patch window often produces temporary changes: open administrative paths, broad outbound access, disabled support sessions and emergency accounts. Each temporary change needs an owner and an expiry time. Review the appliance configuration after the emergency to ensure those exceptions were removed.
Alert on new /login administrators, role changes to Jump Items or teams, new API accounts, security-provider changes and modifications to outbound events or syslog destinations. Also alert on changes to HAProxy routes, startup scripts and sudoers templates. Mandiant documented abuse of those configuration and persistence surfaces in the observed intrusion.
Recheck the external footprint
Keep the approved ZoomEye query and its scope. On November 4, 2026, title="BeyondTrust" returned 973 all-asset page-title matches. That result is a broad external view, not a list of vulnerable appliances. Repeating it can reveal a new public page, a changed title or a service that moved outside the expected network.
Compare the external result with the approved DNS and proxy inventory. Investigate new candidates before assigning risk. Remove a public path only after confirming that users and support operations have another approved route. Monitoring should identify drift without creating a second outage.
Define a reopening gate
The gate should require more than a patch ticket. Confirm that the correct build is present, the configuration matches policy, external access is limited to the intended services, external logs are flowing, privileged credentials have been rotated in the right order and downstream sessions have been reviewed. For a host with unresolved compromise evidence, require a clean rebuild instead of a configuration-only cleanup.
Set a review cadence while the incident remains active. Recheck the external inventory, patch state, configuration drift and log continuity on the same schedule. Keep the evidence with the case. ZoomEye can provide the external discovery layer, while the appliance owner and security operations team provide the configuration and incident evidence needed to reopen safely.