Privileged Remote Access 26.2.1 release notes

To reduce the risk of appliances running with known vulnerabilities, critical security patch enforcement has been strengthened in the following ways:

For critical updates that install without downtime, the option to opt out is removed and these updates are now applied automatically.

For critical updates that require downtime, you can still opt out, but doing so requires you to explicitly acknowledge that you assume responsibility for the associated risk.

If an appliance has not successfully communicated with the update server within a defined time window, key functionality is degraded or disabled. This prevents appliances that are disconnected from updates, whether intentionally or through misconfiguration, from continuing to operate indefinitely in a potentially vulnerable state.

🚧

Important information

• This change removes the ability to opt out of seamless critical security updates. Review your patch management process before upgrading.

You can now assign a Jump Client to multiple Jump Groups when you install it, instead of
updating group membership after deployment. The JC_JUMP_GROUP installer parameter accepts a
comma-separated list of Jump Group identifiers, so an endpoint registers in every specified
group as soon as it comes online.

• Works with Windows MSI, macOS PKG, and Linux installers, so you can deploy through tools
  such as MECM, Intune, or Jamf.
• Existing single-group installer syntax continues to work without changes.

This removes the need for follow-up API calls or scripts to reassign Jump Group membership
after installation.

ℹ️

For information, see Assign a Jump Client to multiple Asset Groups at installation.

Administrators can now enforce FIDO2 authentication at the Group Policy level, using the same
model already available for TOTP enforcement. FIDO2 authentication is also now supported on
Pathfinder deployments.

This gives administrators a way to require phishing-resistant MFA consistently across a user
population, without relying on individual user configuration.

ℹ️

For information, see Group policy settings.

A new report gives you visibility into how your licensed capacity is being consumed over
time. The report shows concurrent usage, time-based trends, and peak usage, and you can
export the data to CSV or PDF, or retrieve it through the API. Access to the report is
controlled by role.

📘

For information, see Licensing reporting.

Privileged Remote Access now streams appliance platform and infrastructure logs through your existing syslog pipeline, so security teams can send appliance-level logs directly to a SIEM for incident detection, investigation, and compliance evidence collection without opening a support ticket.

• Available log types include web server access and error logs, authentication logs,
  SSL/HAProxy logs, and proto-handler logs, among others.
• Log file output is unstructured in this release, so you may need to configure your own parsing rules.

🚧

Important information

This feature is available for on-premises deployments only in this release. Enabling or
disabling individual log categories is not supported yet.

The Duplicate Jump Clients report now supports search and filtering, CSV export, and API
access, so you can manage duplicate Jump Client data programmatically instead of working
through the report manually.

• Search and filter duplicate Jump Client entries directly in the report.
• Export report data to CSV for offline analysis.
• Use the API to detect and resolve duplicates at scale and integrate with your own
  automation.

📘

For information, see Duplicate Jump Client reporting.

Privileged Remote Access now automatically generates an AI-powered summary when a session ends. Each summary
includes a case summary, a step-by-step description of the resolution, system information and
tags such as OS, applications, and issue type, and key highlights from the session.

• Edit a summary after it is generated.
• Export summaries in multiple formats.
• Generate summaries in multiple languages.
• Integrate session summaries with platforms such as Salesforce and ServiceNow.

ℹ️

For information, see AI summaries.

You can now require users to enter a justification before they connect to an asset. When
enabled in the asset policy, a dialog box prompts for a reason of at least 8 characters, and
the session cannot start until a valid justification is entered. The justification is recorded
in audit logs and appears in session and access reports.

• Available in both the Web Console and Access Console.
• If both a ticket ID requirement and a justification requirement are enabled for an asset,
  users are prompted for one or the other, not both.

ℹ️

For information, see Require justification.

Privileged Remote Access brings several vault discovery and management capabilities natively into the product,
reducing the need for Endpoint Credential Manager (ECM) integrations.

• A filter dropdown is added to the Type column on the Vault > Endpoints page.
• Discover, import, and auto-create Jump Items for SSH, Web, and Database systems in Password
  Safe.
• Configure Password Safe Discovery using direct access.

📘

For information, see Manage shadow accounts.

The Web Access Console now supports file transfer during a Web Jump session using the
chat-based file transfer mechanism, so you no longer need to switch to the desktop Access
Console to move files during these sessions.

📘

For information, see Download files using a website.

You can now inject credentials from the vault during an active RDP session — for example, to
run as a different user — without disconnecting and reconnecting. This requires the
BeyondTrust RDP Tools component to be installed on the endpoint. Previously, credential
injection was only available at the start of a session.

ℹ️

For information, see Credential injection for RDP sessions.

The Jump Client is now officially supported on Windows Server Core, including Windows Server
2019 Core, Windows Server 2022 Core, and Windows Core running in Azure.

• Supported deployment scenarios include domain-joined and workgroup environments,
  on-premises and Azure-hosted systems, and silent MSI or scripted deployments.
• Supported capabilities include remote shell sessions, file transfer, session logging and
  recording, credential injection, and client auto-update.

This lets security-focused organizations that standardize on Windows Server Core include
BeyondTrust in their architecture with full support.

ℹ️

For more information, see Deploy Jump Client on Windows Core.

Users can enable keystroke logging to record the keystrokes they enter during Jump
Client sessions and RDP sessions (RDP sessions also require enhanced RDP logging). Captured
keystrokes are stored on the appliance and available for audit and reporting. Input into
password or other secure fields is excluded from capture.

ℹ️

For information, see Keystroke logging.

BeyondTrust clients now run natively on ARM-based systems, such as Windows 11 ARM devices,
instead of requiring x86 emulation. The following capabilities are now natively supported on
ARM:

• Credential injection
• Virtual Smart Card
• Jump Client download via API

ℹ️

• Embedded Support Buttons are not included in this release.
• For more information, see ARM support.

You can now configure vault credentials to be entered automatically when a user
starts a Remote VNC Jump, so users do not need to manually type a username and
password. Because the VNC protocol does not support secure credential injection, credentials
are transmitted in clear text.

This is an opt-in feature that you enable per asset, and it requires acknowledging a consent notice, which is recorded through the Configuration API.

This is especially useful for OT/ICS environments with legacy VNC-accessible endpoints that
cannot run a Jump Client.

ℹ️

This change is for Cloud only.

For more information, see Credential injection for VNC session.

Users can connect to endpoints with very high-resolution displays, including
configurations that exceed 4K, without the severe lag that affected these connections
previously. The endpoint's display is automatically scaled down before being sent to the
user. This release also adds GPU-accelerated capture, scaling, rotation, and format
conversion on Windows endpoints.

When you request access to an asset through the Web Console, you can now type a duration
value directly instead of using increment controls, bringing the Web Console in line with the
Desktop Console.

ℹ️

For more information, see Web console preferences.

The Vault now supports up to 200,000 accounts, giving enterprise customers more room to store
and manage credentials at scale.

The Access Console now displays the private IP address of a connected endpoint
instead of the public IP address seen by the appliance. This gives users accurate
network information, particularly for endpoints behind NAT or in on-premises-to-cloud
migration scenarios.

ℹ️

This change is for Cloud only.

Users can now pop out each remote monitor into its own independent, resizable
window instead of switching between monitors one at a time or viewing them combined in a
single View All window. This is especially useful when remote monitors are in mixed
landscape and portrait orientations.

ℹ️

For information, see Multiple monitors.

The Linux desktop Access Console now runs natively on Wayland instead of running as
an X11 application, including Wayland-based screen capture for features like Show My Screen.

You can now specify an authentication source for MongoDB database tunnel connections that is separate from the target database. Previously, the tunnel authenticated using the target database name, which required the vault user to exist in that same database.

Set the Auth Source field on the jump item to the database where the vault user account resides (for example, admin). When left blank, the tunnel defaults to admin, matching MongoDB's standard behavior for authenticated connections.