BeyondTrust Discovery Agent 26.3.1 release notes
October 22nd, 2026
🆕 New features
This is a maintenance release. There are no new features.
✨ Enhancements
This is a maintenance release. There are no new enhancements.
🛠️ Issues resolved
| Product area | Description | Resolution |
|---|---|---|
| Configuration | OAuth configuration data was overwritten when a connection failed. | OAuth configuration data is now kept when a connection fails. |
| Discovery Scanning | Scan completion events were sometimes sent out of order or dropped. | Scan completion events are now sent in order and reliably delivered. |
| Discovery Scanning | Port scans sometimes reported open ports as closed. On Windows targets, this could skip credentialed enumeration and leave the asset with no services, users, or software data. | Port scans now report open ports correctly, and credentialed enumeration runs as expected. |
| Discovery Scanning | On slow SSH devices or high-latency networks, commands that returned no output but changed the prompt timed out after a fixed 1-second limit. This caused data loss. | A new runtime option sets the timeout for SSH commands that return no output, so scans of slow devices complete without data loss. |
| Discovery Scanning | Scans of Fortinet FortiGate devices running newer OS versions failed to detect the device version and hostname. | Scans now correctly detect the version and hostname of FortiGate devices running newer OS versions. |
| Discovery Scanning | When the scan credential could not read one user's registry hive, the scan stopped collecting software for that user and every user after them. The scan still reported success. | The scan now skips a registry hive it cannot read and continues collecting software for the remaining users. |
| Discovery Scanning | Windows scans could stop responding for up to 24 hours when a target's Service Control Manager didn't respond. | Service enumeration now times out after 30 seconds by default, so the scan moves on to the next target and raises a scan alert. |
| Remote Agents | Deploying a remote agent extension in an impersonated session failed with an error. | Remote agent extensions now deploy successfully in impersonated sessions. |
| Remote Agents | When the remote agent had already shut down during a scan, later enumeration steps logged a misleading warning about copying files to the target. | The scanner now skips remote agent extension commands when the agent is not available, without logging a misleading warning. |
| Remote Agents | The support package escrow envelope reported the wrong agent version. | The support package escrow envelope now reports the correct agent version. |
🚧 Known issues
Run btdiscovery.cmd from Windows Command Prompt
Windows PowerShell does not properly send the command line options for
btdiscovery.cmd to the program. This command needs to be run in a standard windows command shell.
Sybase authentication is not supported for IPv6.
Sybase authentication supports IPv4 connections only and does not support IPv6.
MySQL 9 on Linux enumeration is not supported at that time.
Password Safe does not support MySQL 9 enumeration on Linux.
Discovery Agent does not support .NET Hosting 8.0.1
The Discovery Agent does not run with .NET Hosting 8.0.1. Downgrade to version 8.0.0 or upgrade to version 8.0.2 or later.
📝 Requirements
- The .NET 10 Hosting package must be installed.
- OAuth authorization requires BeyondInsight 24.2.0.
- Retrieving all scheduled scans through the Central Policy message requires BeyondInsight 24.3.0 or later.
🗒️ Notes
- This release is available by download from the BeyondTrust Client Portal (https://www.beyondtrust.com/support/).
- The SHA-256 signature is: cc387d353d6a271844f93881bad8e6fadfeff97699134774e8a363e7bd8f51c0
- The SHA-1 signature is: ebc2d8b3131271f14f3d5254beb52e090b0b3e44
- The MD5 signature is: da8c044dd28fed1a8a0dace2fd15efab
⏰ Deprecation notices
- Windows 8 and Windows Server 2012 are no longer supported as scanner hosts.
- Windows Server 2016 as a scanner host is deprecated.
- Support for SSH Session encryption using the SHA1 cipher is removed. SHA256 or higher should be used.
- Support for DSA encryption as an SSH authentication cipher has been removed.
- Support for Windows 8 and Server 2012 as a scanner host is no longer supported.
- Support for Server 2016 as a scanner host is deprecated.
⌛ End of support
The product versions below have reached, or are nearing, their end of support. Upgrade to the latest version to continue receiving updates and support. Support ends on the last day of the month listed below.
For more information about supported versions, see Product Support Life Cycle.
| Product version | End of support |
|---|---|
| Out of support | |
| Password Safe 24.2.x | September 2026 |
| Near end of support | |
| Password Safe 24.3.x | December 2026 |
