Password Safe 24.3 runs out of support in December, and 26.3 is still one upgrade away

BeyondTrust stops supporting Password SafedefinitionBeyondTrust's password vault for privileged accounts. People check passwords out of it, it rotates them afterwards, and it records the session. 24.3 at the end of December 2026. If you run it on premises, plan the move to 26.3 now, while 26.3 still accepts 24.3.0 as a direct upgrade source. The jump covers two years of releases, and a few of the changes in between will break scripts and integrations that work today.

A privileged access vault sits at the top of your security chain. If someone gets into it, they don't need to break anything else. That's why auditors and cyber insurers ask whether it's on a supported version, and an out-of-support PAM product is the kind of finding that ends up in the board report.

Nothing stops on 1 January. Rotation keeps running and people keep checking out passwords. The trouble comes later: a flaw gets published, the fix only goes into 26.x, and you're upgrading two years of releases under pressure instead of in a planned window.

There's also a quieter reason to move now. Each new release raises the oldest version you can upgrade from in one step. 26.1 accepted 24.1.1 or later, 26.2 needs at least 24.2, and 26.3 takes 24.3.0 or later. BeyondTrust hasn't said what the next release will accept. If the floor keeps rising, a site that waits could face two upgrades instead of one.

For engineers: the direct-upgrade floor is in each release's notes. 25.3.0 accepted 23.3 or later, 26.1 accepted 24.1.1 or later, 26.2 needs 24.2, and 26.3 needs 24.3.0. That's why the advice is 26.3 specifically. It's the newest release your 24.3 install can reach in one step today.

Most of the two years is new features you can adopt later. The part that bites is a short list of removals and stricter defaults. We pulled these from the release notes for 25.1, 25.3, 26.1, 26.2 and 26.3, and they're the items to test before production.

The Public APIdefinitionThe way scripts and tools pull credentials from Password Safe or manage it. When it changes, integrations are usually what breaks. change is the one we'd test hardest. Password Safe usually has scripts and tools pulling credentials out of it: deployment pipelines, scheduled jobs, ticketing integrations. Each of them talks to the API. A stricter parser won't break the vault, but it can break whatever depends on it at 2 a.m., and those callers often belong to other teams.

The SQL Server item catches people too. BeyondTrust still lists SQL Server 2016 SP2 as its minimum. Microsoft's extended support for SQL Server 2016 ended in July 2026, though, and BeyondTrust only guarantees platforms their own vendor still supports. So 2016 is the floor on paper, and you'd want 2019 or 2022 under a vault you plan to keep for years.

There's also an old platform change to clean up. 24.3 already deprecated the Cloud - Azure and Cloud - Office 365 platforms in favour of the Microsoft Entra ID platform, with no automated migration. By 26.1 BeyondTrust said they no longer work properly and would be removed starting in 26.2. If any managed accounts still sit on those platforms, move them by hand before you upgrade.

On premises, the 26.3 package comes from the BeyondTrust customer portal or BT Updater. The release notes publish SHA-256 hashes for the package, so check the download against them before it goes anywhere near the vault.

The order matters more than the clicks. Get the database and runtimes right first, then fix the integrations that the breaking changes will hit. Rehearse on a copy, and only then touch production.

Staying supported is the main reason to move, but a few changes are worth a look while you're there. None of them has to be switched on during the upgrade.

• Auditors: 25.3 split the Auditor role into Auditor-Sessions and Auditor-Reports. You can scope each reviewer more tightly than before.
• Teams with MFA-protected apps: since 25.3, a checked-out managed account can use TOTP codes. 26.3 also lets you keep the TOTP secret next to the credential.
• Developers and pipeline owners: 26.2 can onboard, rotate and hand out AWS access keys and Azure service principal secrets, including through CI/CD.
• Secrets owners: 26.2 adds versioning in Secrets Safe, so you can see what changed and roll a secret back.
• Network teams: 25.3 adds IPv6 support for discovery, scanning, sessions and rotation.
• Report owners: rebuild subscriptions on 26.3's own delivery, which doesn't need SSRS. Then the SSRS removal won't touch you.

We implement and upgrade BeyondTrust Password Safe, and the BeyondTrust page lists what we cover. For this deadline we'd start with a short inventory of versions, platforms and vault callers, then rehearse the 26.3 upgrade on a copy and run the production cutover with your team. If you need engineers to do the work, see BeyondTrust engineers for hire, or start with a free assessment.