CISA set a remediation due date of 2026-10-19 for CVE-2026-102764 under BOD 26-04, and required forensic triage alongside it. Binding or not, the schedule that directive implies works as a template: a month is enough time to go from not knowing what is exposed to being able to evidence remediation.
Days 1 to 5: establish the list
Run the exposure query against owned address space, certificate subject names and hostname patterns, and record the collection time for every result. Then reconcile the answer against the asset register.
ZoomEye reported 2,185 assets matching app="Bomgar" globally on 2026-10-26; the organisation-specific number will be smaller and is the one that governs the plan. Any host that appears externally and not internally has no owner yet, and assigning one is the first deliverable.
Exit criterion: every externally visible appliance has a named owner and a change record.
Days 6 to 10: contain and confirm
The vulnerability permits file operations with no privileges and no user interaction, and exploitation has been confirmed in the wild. Containment comes before verification.
Remove internet reachability for any appliance that cannot evidence a current build, and restrict support sessions to managed access paths. Confirm the build on the device itself, not from a management console's assumption.
Exit criterion: no appliance answering on the public internet without either a verified current build or an approved compensating control.
Days 11 to 20: investigate and rotate
The reporting states the actor obtained every credential the appliance stored and modified files that survive reboots and configuration resets. Both facts have to be assumed true for any appliance that was exposed and unverified.
Capture authentication logs and file hashes before touching the device. Rotate the credentials the appliance used, then the downstream credentials those accounts could reach, then revoke sessions and refresh tokens for the same set. Where an appliance cannot be brought to a verified state, rebuild it from vendor media rather than attempting to clean it.
Exit criterion: every credential the appliance could hold has been rotated or revoked, and every appliance is either verified clean or rebuilt.
Days 21 to 30: evidence and watch
Produce a record that a reviewer can check: which appliances existed, which were externally visible, which were patched, which were rebuilt, which credentials were rotated and when. Then set the exposure query on a recurring schedule so that a new externally visible appliance becomes an alert rather than a discovery.
Exit criterion: a signed remediation record and a scheduled external-exposure check.
Where the plan breaks
Three failure modes recur. The first is patching the appliance and skipping credential rotation, which leaves the stolen material live. The second is capturing the file baseline after the investigation starts, which destroys the comparison. The third is treating the global count as a progress metric; 2,185 assets matching a fingerprint is a population figure that will barely move in thirty days, and internal completion is the number that matters.
What the plan does not cover
A thirty-day plan cannot establish that an appliance was never accessed if logging was insufficient before the incident, and it cannot substitute for an intelligence assessment of whether a specific organisation is a plausible target. It covers the work that is knowable and verifiable, which is most of the remediation.
References
The Record, "Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day": https://therecord.media/beyond-trust-cyberattack-china
NVD, CVE-2026-102764: https://nvd.nist.gov/vuln/detail/CVE-2026-102764
CISA Known Exploited Vulnerabilities catalog, CVE-2026-102764: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764
BeyondTrust advisory BT26-05: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
ZoomEye search used for the published count: https://www.zoomeye.ai/searchResult?q=YXBwPSJCb21nYXIi