https://cybertoolchain.io/tools/beyondtrust New releases and features in BeyondTrust, tracked by The Cyber Toolchain. en Tue, 03 Nov 2026 19:00:00 GMT https://docs.beyondtrust.com/rs/changelog/remote-support-26-3-1-release-notes https://docs.beyondtrust.com/rs/changelog/remote-support-26-3-1-release-notes Tue, 03 Nov 2026 19:00:00 GMT BeyondTrust Remote Support 26.3.1 adds end-user consent in RDP sessions, FIDO2 on Pathfinder, Configuration API via MCP gateway, and AI Session Summaries for Atlas deployment⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new APIs: access the Configuration API through the MCP gateway so AI assistants and automation tools can read and change RS configuration settings without a custom REST integration, with read and write access controlled at the organization level; assign attended and unattended session policies to a group policy through the API, removing the manual UI step from provisioning scripts; and retrieve AI Session Summaries through public APIs for use in reporting, storage, and analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new session control policies: BeyondTrust Remote Support now requires end-user consent before a representative can share the screen, access files, or access the shell in an active RDP session, with consent re-requested on mid-connection session switches; and administrators can use a session policy to start screen sharing in view-only mode, requiring the representative to request end-user approval before taking control. • Turn session recording on or off for a single Asset or Asset Group, overriding the global recording policy, via Jump Policies settings. • Schedule Endpoint Automation jobs on a one-time or recurring basis for specific Jump Groups, tags, or endpoints, with run windows, concurrency limits, and automatic retries. • AI Session Summaries now writes summaries into matching ServiceNow incidents automatically, pulls ticket context from ServiceNow, covers the full session recording rather than only the first ten minutes, and is now available for Atlas deployments. • Remote Support on Pathfinder now supports FIDO2 authentication, allowing representatives and administrators to register and sign in with FIDO2 security keys or platform authenticators. • The Status page in `/login` now shows a Total Active Users count (users who signed in within the last 365 days and still exist) immediately after the Time Zone field. • Adds new Jump Client controls: set how many days a Gateway can go without connecting before it uninstalls itself via the Jump Client maintenance settings in `/login` (the default remains 30 days); and control Jump Client upgrades by Jump Group, allowing staged rollouts to test a subset of endpoints before upgrading all. • Adds new traffic-node routing controls: control whether the traffic node selector appears on the representative web login page via a new setting on the Cluster tab in `/login` (when hidden, RS connects representatives to the closest available traffic node automatically); and cloud administrators can now choose traffic-node routing — `SRV Record Lookup` (default), `Random`, or `Timezone Offset` — under Management > Cluster > Traffic Nodes. • Session reports in `/login` and the Reporting API now include the `Comment` and `Tag` values set on Jump Clients. Breaking changes: • RADIUS authentication will be removed in the 27.1 release; migrate to SAML, LDAP, or another supported authentication method before upgrading to 27.1. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/beyondtrust https://docs.beyondtrust.com/rs/changelog/base-8-4-0-release-notes https://docs.beyondtrust.com/rs/changelog/base-8-4-0-release-notes Tue, 03 Nov 2026 17:00:00 GMT BeyondTrust Base 8.4.0 adds coordinated cluster updates and Canadian French language support for the appliance admin interface⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Clustered and failover deployments now update as a unit — the primary schedules both base and product updates and every node installs them in the same maintenance window, with per-node status visible on the cluster Updates page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • The appliance administrative interface is now available in Canadian French. • Rate limiting now limits burst and sustained request rates independently, so short legitimate traffic bursts are no longer throttled as sustained abuse. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/beyondtrust https://docs.beyondtrust.com/rs/changelog/endpoint-credential-manager-1-6-2609-release-notes https://docs.beyondtrust.com/rs/changelog/endpoint-credential-manager-1-6-2609-release-notes Wed, 16 Sep 2026 16:00:00 GMT ECM 1.6.2609 adds configurable certificate validation and field-debugging settings via named appSettings keys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `requireCertificateRevocationCheck` appSettings key (default `false`) to reject certificates whose revocation status cannot be determined, for hosts without a reachable CRL or OCSP endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `allowUntrustedApplianceCertificate` appSettings key (default `false`) to accept appliance certificates that do not chain to a trusted root, for hosts where the issuing CA is not yet installed. • Adds `MaxReturnedCredentials` appSettings key to override the credential result limit in configuration (raised ceiling: 750) without requiring a rebuild. • Adds `VerbosePluginExceptions` appSettings key to return full plugin exception text to the appliance for field debugging, replacing the default correlation-ID-only response. • Documents every appSettings key ECM reads in `Example.config`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/beyondtrust https://docs.beyondtrust.com/rs/changelog/remote-support-26-3-1-pre-release-notice https://docs.beyondtrust.com/rs/changelog/remote-support-26-3-1-pre-release-notice Tue, 15 Sep 2026 16:00:00 GMT BeyondTrust Remote Support 26.3 introduces automatic version upgrades with configurable Fast Track, Standard Track, and Enterprise Track channels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables automatic version upgrades during configured maintenance windows via the `Automatic Updates Channel` setting (Fast Track, Standard Track, or Enterprise Track), building on the channel setting introduced in 25.3.1.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a rollout schedule that staggers upgrades by channel: Fast Track sites begin upgrading to 26.3.x in mid-November 2026, Standard Track after 27.1 GA, and Enterprise Track after 27.2 GA — no deployment is ever moved to a version older than 26.3. • Allows opting out by clearing `Automatically install the latest updates during maintenance day(s) and time` in the `/appliance` Updates > Maintenance Window interface, while retaining manual update capability. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/beyondtrust https://docs.beyondtrust.com/rs/changelog/integration-client-26-2-1-release-notes https://docs.beyondtrust.com/rs/changelog/integration-client-26-2-1-release-notes Wed, 09 Sep 2026 16:00:00 GMT Integration Client 26.2.1 adds session asset columns and configurable HTTP timeouts via new config keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `DownloadTimeoutSeconds`, `ApiRequestTimeoutSeconds` (default: 300 s), and `ApiInfoTimeoutSeconds` (default: 60 s) config keys so HTTP timeouts are bounded and tunable per environment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds four nullable session columns — `asset_type`, `asset_name`, `asset_comments`, and `asset_tag` — to both the Analytics DB Plugin and the SQL Server Plugin, populated from the Reporting API, so reporting teams can correlate session activity with the worked-on asset without joining an external inventory source. Breaking changes: • The User Account / API Account toggle is removed from Site Configuration — every site must now be configured with a `Client ID` and `Client Secret`; any site that relies on username and password API authentication must be reconfigured before it will function. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/beyondtrust https://docs.beyondtrust.com/rs/changelog/endpoint-credential-manager-1-6-2606-release-notes https://docs.beyondtrust.com/rs/changelog/endpoint-credential-manager-1-6-2606-release-notes Thu, 13 Aug 2026 16:00:00 GMT ECM 1.6.2606 adds configuration self-heal, env-variable support for ConfigCLI, and richer plugin-load diagnostics. • Adds `env:` prefix support in `ConfigCLI` arguments so sensitive values can be resolved from environment variables instead of the command line, keeping them out of process creation logs. • Adds configuration self-heal: the ECM service and Configurator automatically detect and repair a missing or stale configuration file at startup and during installation, preserving `appSettings`, proxy, and log configuration while refreshing only version-driven sections. • Improves plugin load diagnostics by logging assembly load failures with full detail, replacing the opaque 'Found 0 plugins' message when tools such as WDAC, AppLocker, or EDR solutions block plugin loading. • Hardens plugin loading by loading plugins from the install directory rather than the process working directory. • Switches the credential store to per-installation encryption entropy, replacing a previously shared value. • Restricts configuration deserialization to known types. • Enables certificate revocation checking on the appliance connection and enforces size limits on protocol and HTTP reads. • Changes log appenders to fail closed rather than falling back to an unprotected credential value. • Upgrades the `log4net` dependency from 3.1.0 to 3.3.1. • Creates a new `ECSM.entropy` file in the install directory as part of per-installation encryption; should be backed up alongside `ECSM.settings`. Breaking changes: • Certificate revocation checking is now enforced on the appliance connection — CRL/OCSP endpoints must be reachable from the ECM host before upgrading. • Plaintext credential values in log appender configuration must be re-encrypted before upgrading, as log appenders now fail closed rather than falling back to an unprotected credential value. • The credential store now uses per-installation encryption entropy; a new `ECSM.entropy` file is created in the install directory and must be backed up alongside `ECSM.settings`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/beyondtrust https://docs.beyondtrust.com/rs/changelog/ios-representative-console-3-1-11-release-notes https://docs.beyondtrust.com/rs/changelog/ios-representative-console-3-1-11-release-notes Thu, 30 Jul 2026 16:00:00 GMT BeyondTrust iOS Representative Console 3.1.11 adds audio support during Jump Client sessions. • Adds audio playback from the remote system during Jump Client sessions on iOS, enabling a fuller remote access experience. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/beyondtrust https://docs.beyondtrust.com/rs/changelog/base-8-3-0-release-notes https://docs.beyondtrust.com/rs/changelog/base-8-3-0-release-notes Thu, 16 Jul 2026 18:00:00 GMT BeyondTrust Base 8.3.0 brings OCSF-structured syslog, a unified patch inventory view, and upload progress visibility. • Remote syslog output now follows OCSF structure, enabling richer, standardized event forwarding to SIEM platforms with new log categories for on-premises appliances. • Local file uploads now show an estimated progress bar instead of a generic spinner, giving clearer visibility into upload duration. • Removes the opt-in default certificate mechanism, simplifying certificate configuration. Breaking changes: • The ability to opt out of seamless (no-downtime) critical security updates is removed; these updates now apply automatically on on-premises appliances. • If an appliance has not successfully communicated with the update server within a defined time window, key functionality is degraded or disabled. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/beyondtrust https://docs.beyondtrust.com/rs/changelog/remote-support-26-2-1-release-notes https://docs.beyondtrust.com/rs/changelog/remote-support-26-2-1-release-notes Thu, 16 Jul 2026 18:00:00 GMT BeyondTrust Remote Support 26.2.1 adds multi-group Jump Client installs, FIDO2 Group Policy enforcement, AI session summaries, syslog streaming, and ARM-native support. • Assigns a Jump Client to multiple Jump Groups at installation time via a comma-separated `JC_JUMP_GROUP` installer parameter, eliminating post-deployment API calls to reassign group membership. • Enforces FIDO2 phishing-resistant MFA at the Group Policy level, using the same model as existing TOTP enforcement; FIDO2 is also now supported on Pathfinder deployments. • Adds search, filtering, CSV export, and API access to the Duplicate Jump Clients report for programmatic duplicate detection and resolution at scale. • Automatically generates AI-powered session summaries on session end, including case summary, step-by-step resolution, system tags, and key highlights; summaries are editable, exportable in multiple formats, multi-language, and integrate with Salesforce and ServiceNow. • Brings vault discovery and managed/shadow account capabilities natively into the product, including a filter dropdown on the Vault > Endpoints page, new import and auto-create options for SSH, RDP, and Password Safe Jump Items, and a direct-access Password Safe Discovery method. • Adds a Collaboration Mode shortcut in the Representative Console to start a screen-sharing session with yourself and immediately invite other representatives, replacing the legacy Presentation feature. • Supports vault credential injection during an active RDP session (run-as scenario) without disconnecting, requiring the BeyondTrust RDP Tools component on the endpoint. • Streams appliance platform and infrastructure logs (web server access/error, authentication, SSL/HAProxy, proto-handler, and more) to an existing syslog destination for SIEM integration; available for on-premises deployments. • Officially supports the Jump Client on Windows Server Core (2019, 2022, and Azure-hosted), including remote shell, file transfer, session recording, credential injection, and auto-update. • Runs BeyondTrust clients natively on ARM-based systems (e.g., Windows 11 ARM) without x86 emulation, covering credential injection, Virtual Smart Card, and Jump Client download via API. • Supports vault credential auto-entry for Remote VNC Jump sessions (Cloud only), enabled per asset via the Config API with a recorded consent notice, useful for OT/ICS legacy endpoints. • Allows representatives to pop out each remote monitor into its own independent, resizable window instead of cycling through monitors one at a time. • Scales the Vault to support up to 200,000 accounts. Breaking changes: • The ability to opt out of seamless (no-downtime) critical security updates is removed; these updates are now applied automatically on upgrade. • RADIUS authentication provider is deprecated: existing configurations can be edited but new ones cannot be created — migrate to SAML or LDAP before future versions remove the provider entirely. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/beyondtrust https://docs.beyondtrust.com/rs/changelog/remote-support-25-3-5-release-notes https://docs.beyondtrust.com/rs/changelog/remote-support-25-3-5-release-notes Tue, 30 Jun 2026 16:00:00 GMT Remote Support 25.3.5 adds LDAP authentication and SCIM integration support through Pathfinder. • Adds LDAP authentication support via Pathfinder, enabling user validation against existing directory services with improved login reliability and error feedback. • Adds SCIM integration for Pathfinder, enabling automated user and access synchronization with identity providers to reduce manual administration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/beyondtrust