Remote Support 26.2.1 release notes

To reduce the risk of appliances running with known vulnerabilities, critical security patch enforcement has been strengthened in the following ways:

• For critical updates that install without downtime, the option to opt out is removed and these updates are now applied automatically.
• For critical updates that require downtime, you can still opt out, but doing so requires you to explicitly acknowledge that you assume responsibility for the associated risk.
• If an appliance has not successfully communicated with the update server within a defined time window, key functionality is degraded or disabled. This prevents appliances that are disconnected from updates, whether intentionally or through misconfiguration, from continuing to operate indefinitely in a potentially vulnerable state.

🚧

Important information

• This change removes the ability to opt out of seamless critical security updates. Review your patch management process before upgrading.

You can now assign a Jump Client to multiple Jump Groups when you install it, instead of
updating group membership after deployment. The JC_JUMP_GROUP installer parameter accepts a
comma-separated list of Jump Group identifiers, so an endpoint registers in every specified
group as soon as it comes online.

• Works with Windows MSI, macOS PKG, and Linux installers, so you can deploy through tools
  such as MECM, Intune, or Jamf.
• Existing single-group installer syntax continues to work without changes.

This removes the need for follow-up API calls or scripts to reassign Jump Group membership
after installation.

ℹ️

For information, see Assign a Jump Client to multiple Asset Groups at installation.

Administrators can now enforce FIDO2 authentication at the Group Policy level, using the same
model already available for TOTP enforcement. FIDO2 authentication is also now supported on
Pathfinder deployments.

This gives administrators a way to require phishing-resistant MFA consistently across a user
population, without relying on individual user configuration.

ℹ️

For information, see Group policy settings.

The Duplicate Jump Clients report now supports search and filtering, CSV export, and API
access, so you can manage duplicate Jump Client data programmatically instead of working
through the report manually.

• Search and filter duplicate Jump Client entries directly in the report.
• Export report data to CSV for offline analysis.
• Use the API to detect and resolve duplicates at scale and integrate with your own
  automation.

ℹ️

For information, see Duplicate Jump Client reporting.

Remote Support now automatically generates an AI-powered summary when a session ends. Each
summary includes a case summary, a step-by-step description of the resolution, system
information and tags such as OS, applications, and issue type, and key highlights from the
session.

• Edit a summary after it is generated.
• Export summaries in multiple formats.
• Generate summaries in multiple languages.
• Integrate session summaries with platforms such as Salesforce and ServiceNow.

ℹ️

For information, see AI summaries.

Remote Support brings several vault discovery and management capabilities natively into the
product, reducing the need for Endpoint Credential Manager (ECM) integrations.

• A filter dropdown is added to the Type column on the Vault > Endpoints page.
• Add additional options to discover, import, and auto-create Jump Items for SSH, RDP, Jump Items in Password Safe. Organizations using Password Safe can now streamline jump item provisioning for SSH, web, and database targets.
• Configure an additional method of Password Safe Discovery using Direct access. It is assumed that the SRA user is also a Password Safe user. In this case, credentials are discovered at the time of need (that is, credential injection, same as ECM) and import is skipped.

ℹ️

For more information, see Manage shadow accounts.

A new shortcut in the Representative Console lets you start a screen-sharing session with
yourself and immediately invite other representatives, replacing the legacy Presentation
feature and the workaround of manually starting a session with your own system.

• No Jump Client is required on your own machine.
• Each invited representative consumes a concurrent license.
• Invited representatives can view the screen but cannot take control.

ℹ️

For more information, see Share screen in Collaboration Mode.

You can now inject credentials from the vault during an active RDP session, for example, to
run as a different user, without disconnecting and reconnecting. This requires the
BeyondTrust RDP Tools component to be installed on the endpoint. Previously, credential
injection was only available at the start of a session.

ℹ️

For information, see Credential injection for RDP sessions.

Remote Support now streams appliance platform and infrastructure logs through your existing syslog pipeline, so security teams can send appliance-level logs directly to a SIEM for incident detection, investigation, and compliance evidence collection without opening a support ticket.

• Available log types include web server access and error logs, authentication logs,
  SSL/HAProxy logs, and proto-handler logs, among others.
• Log file output is unstructured in this release, so you may need to configure your own
  parsing rules.

🚧

Important information

This feature is available for on-premises deployments only in this release. Enabling or
disabling individual log categories is not supported yet.

The Jump Client is now officially supported on Windows Server Core, including Windows Server
2019 Core, Windows Server 2022 Core, and Windows Core running in Azure.

• Supported deployment scenarios include domain-joined and workgroup environments,
  on-premises and Azure-hosted systems, and silent MSI or scripted deployments.
• Supported capabilities include remote shell sessions, file transfer, session logging and
  recording, credential injection, and client auto-update.

This lets security-focused organizations that standardize on Windows Server Core include
BeyondTrust in their architecture with full support.

ℹ️

For more information, see Deploy Jump Client on Windows Core.

BeyondTrust clients now run natively on ARM-based systems, such as Windows 11 ARM devices,
instead of requiring x86 emulation. The following capabilities are now natively supported on
ARM:

• Credential injection
• Virtual Smart Card
• Jump Client download via API

ℹ️

• Embedded Support Buttons are not included in this release.
• For more information, see ARM support .

You can now configure vault credentials to be entered automatically when a representative
starts a Remote VNC Jump, so representatives do not need to manually type a username and
password. Because the VNC protocol does not support secure credential injection, credentials
are transmitted in clear text. This is an opt-in feature that you enable per asset, and it
requires acknowledging a consent notice, which is recorded through the Config API.

This is especially useful for OT/ICS environments with legacy VNC-accessible endpoints that
cannot run a Jump Client.

ℹ️

For more information, see Credential injection for VNC session.

The Representative Console now displays the private IP address of a connected endpoint
instead of the public IP address seen by the appliance. This gives representatives accurate
network information, particularly for endpoints behind NAT or in on-premises-to-cloud
migration scenarios.

Representatives can now pop out each remote monitor into its own independent, resizable
window instead of switching between monitors one at a time or viewing them combined in a
single "View All" window. This is especially useful when remote monitors are in mixed
landscape and portrait orientations.

ℹ️

For information, see Multiple monitors.

The Vault now supports up to 200,000 accounts, giving enterprise customers more room to store
and manage credentials at scale.