Suppose a service provider tells you it patched the appliance its technicians use to reach your network. Can you close the incident? The patch confirmation answers a question about the appliance today. It leaves another question open: did anyone use that access before the fix?
BeyondTrust’s October 15, 2026 advisory addressed CVE-2026-102764 in Remote Support. BeyondTrust reported patching its hosted service by October 9 and provided remediation instructions for self-hosted customers, including an upgrade step for older versions. In a separate investigation published October 15, Mandiant documented exploitation in late August, before disclosure. Its investigators found that an intruder established persistent access and deleted logs. Those findings describe an investigated intrusion; they do not establish that every exposed appliance or customer network was compromised.
For leaders who depend on remote support, the distinction matters. One team may own the appliance, another the credentials, and a third the systems a technician can reach. Here is how I would divide the work so the question about prior access gets an answer.
Give the patch and the investigation separate owners
Have the platform owner identify each instance, its hosting model, its version and when the fix took effect. Include appliances operated on your behalf. A supplier’s assurance about its hosted service tells you little about a separate appliance a contractor maintains for your organization. Use the vendor’s current advisory for the appropriate fix.
Give incident response a different assignment: determine what the available records say about use of that access before remediation. Run the two efforts in parallel. Coordinate evidence preservation with responders so that rebuilding an appliance does not destroy the only records available. Equally, do not leave an exposed system online merely to finish collecting routine inventory.
Follow one session all the way to its destination
Choose a privileged support session during the period under review. Ask the provider for its timestamp, account, target and associated support ticket. Then ask your own team to reconstruct the same event from independently retained records: a gateway connection, a sign-in on the destination or an endpoint event. Compare time zones before deciding two records disagree.
Imagine a university’s facilities contractor connecting to a building management workstation on a Sunday. An unusual hour alone proves little; there may have been a legitimate heating fault. A matching work order, named technician and destination log give the response team a way to test that explanation. A valid ticket for one building does not explain a connection to another. That discrepancy merits investigation. A missing log, by contrast, is an evidence gap: record what cannot be determined and why.
One reconciled session demonstrates that the investigation method works. It does not clear the rest. Use what you learn to expand the review to other privileged sessions, unexpected destinations and periods when expected records went quiet.
Decide how support can continue safely
If the primary access path has to be isolated, who can still help restore service? For a plant or hospital, taking away remote support during a fault can have operational consequences. Agree with operations on a temporary alternative: for example, a named technician using a supervised connection to one designated system for a limited window. Identify who can terminate the session. Test that the alternative works without relying on the appliance under investigation.
For the next supplier review, ask for a demonstration using a recent authorized maintenance visit. Can the provider produce the session record? Can your team corroborate it? Who can revoke access outside business hours, and how long will the evidence remain available? The demonstration will tell you more about response readiness than a checkbox stating that remote access is monitored.
When leadership asks whether the incident is closed, give two answers: when the entry point was fixed, and what the investigation established about earlier access. Where evidence has expired, name the systems affected by that uncertainty, the safeguards now in place and the person accountable for deciding whether further investigation is warranted.