BeyondTrust Remote Support and Privileged Remote Access Security Advisory: BT26-03

Action Required
BeyondTrust has published Security Advisory BT26-03 (https://www.beyondtrust.com/trust-center/security-advisories) relating to multiple vulnerabilities affecting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA).

Customers using self-hosted BeyondTrust Remote Support or Privileged Remote Access should review their current versions and ensure that the relevant security updates have been applied.

Impact
The advisory includes Critical and High severity vulnerabilities. The most severe vulnerabilities may allow an unauthenticated attacker to bypass access controls and gain unauthorised access to the appliance under specific configurations. Additional vulnerabilities may result in service disruption, unintended data access, or elevated access by an authenticated user with specific permissions.

The affected versions are:

• Remote Support RS 25.3.2 or lower
• Privileged Remote Access PRA 25.3.2 or lower

Current Status
BeyondTrust has confirmed that patches have already been applied to all RS/PRA cloud customers.

Self-hosted customers should apply the relevant April 2026 Security Rollup for their deployed version where automatic updates are not enabled, or upgrade to:

• Remote Support RS 25.3.3 or above
• Privileged Remote Access PRA 25.3.3 or above

Recommended Action
Customers should review the BeyondTrust BT26-03 Security Advisory and confirm whether their environment is affected.

Where required, customers should apply the relevant security rollup or upgrade to the fixed versions as soon as possible, particularly where Remote Support or Privileged Remote Access is externally accessible.

Advisory ID: BT26-02

CVE-2026-1731

BeyondTrust Remote Support and older versions of Privileged Remote Access contain a critical pre-authentication remote code execution vulnerability that may be triggered through specially crafted client requests. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.

• Synopsis: Remote code execution in Remote Support (RS) and Privileged Remote Access (PRA)
• Affected Product: Remote Support (RS) and Privileged Remote Access (PRA)

Observed exploitation activity has been limited to internet-facing, self-hosted environments where the patch had not been applied before February 9, 2026.

Important: BeyondTrust is strongly encouraging all self-hosted customers who had internet-exposed instances that remained unpatched as of February 9 to take immediate action to apply the recommended updates and open a “Severity 1” ticket to BeyondTrust support, citing “BT26-02” in the description.

Affected Versions:

Remote Support – 25.3.1 and prior

Privileged Remote Access – 24.3.4 and prior

CyberArk is now Idira® – Next-Generation Identity Security Platform

On June 8th, CyberArk announced its rebrand to Idira®, a next-generation identity security platform built on CyberArk’s foundations and powered by Palo Alto Networks.

The transition is being rolled out in phases:

• Phase 1 (Visual updates): New Idira branding will begin appearing across the product UI, documentation, and automated system emails.
• Subsequent phases: Technical touchpoints such as product URLs and APIs will remain unchanged for now. Further updates will be communicated in advance.

For full details on what’s changing, visit the Idira FAQ page.

CyberArk: CA26-23 – Incomplete IIS documentation for the z/OS Central Credential Provider (CCP) can cause weak authentication.

Impact: Incomplete configuration instructions in the documentation for the IIS that hosts the Central Credential Provider (CCP) for the z/OS Credential Provider can lead to weak authentication.

CA26-23 involves a Critical severity issue that affects:

• z/OS Credential Provider, all versions.

For complete details on the vulnerabilities, recommendations, and update instructions, please review the Security Bulletin, that can be found in the Technical Community:

https://www.cyberark.com/ca26-23

Learn more by visiting Product Security | CyberArk