BeyondTrust Remote Support and PRA 24.3 lose support in November, and there's no one-step upgrade

BeyondTrust stops supporting Remote SupportdefinitionBeyondTrust's tool for help desks to see and control a user's device. It used to be called Bomgar. 24.3 and Privileged Remote AccessdefinitionBeyondTrust's tool for admins and vendors to reach servers and network gear, often with credentials it injects so nobody sees them. 24.3 at the end of November 2026. If you run either on your own appliance, start the upgrade this month, and plan for more than one hop: the published notes don't give 24.3 a direct path to 26.x.

Attackers like these appliances for a simple reason: get control of one and you can reach everything it reaches. From late August a group used an exploited Remote Support flaw (CVE-2026-102764) before any patch existed, and CISA added it to its Known Exploited Vulnerabilities list after disclosure in October. The BT26-05-RS patch went out for 24.3.1 through 26.2.3. Whatever turns up next year won't get a 24.3 patch.

Nothing goes down on 1 December. The real worry is the next advisory. If you're still on 24.3 when it comes out, the fix sits several upgrades away, and you'd be running those hops in a hurry with the appliance exposed.

There's a second reason to move now. BeyondTrust's new automatic upgrades, which start with 26.3.1, only pick up appliances already on 25.3.1 or later. Sites on 25.2 or older get nothing automatically. You have to climb to 25.3.1 by hand before the vendor will carry you any further.

For engineers: every release note ends with a requirements block naming the BasedefinitionThe appliance's own operating software. Every Remote Support or PRA release needs a minimum Base, so you often update Base first. version it needs and the oldest version it upgrades from. Read them in a row and the path from 24.3 falls out. The table in the next chapter does that for you, and your /appliance update list will grey out any package whose prerequisite you haven't installed yet.

Two years of releases sit between 24.3 and 26.3.1. Most of it is new features you can adopt later. The items below are the ones that can stop an upgrade, break a sign-in or change how you run the appliance, so test them before you cut over.

The upgrade path is the part we'd plan hardest. Each hop is a BeyondTrust package with a Base software prerequisite, and BeyondTrust recommends waiting at least 24 hours after each package so Jump Clients, consoles and Jumpoints can pull the intermediate updates. Three or four hops can't be squeezed into one Saturday. If you can't wait between hops, the documented fallback is to remove every client, install the packages in sequence and reinstall the clients afterwards, which is usually worse.

RADIUSdefinitionAn old network sign-in protocol often used to connect reps to token or MFA servers. BeyondTrust removes it in 27.1. is the change that reaches outside the BeyondTrust team. If your reps sign in through RADIUS, it usually points at an MFA server or a token system that someone else owns. The removal date has already moved once: 26.1.1 said RADIUS would go in 26.2.1, and 26.2.1 hid it from new setups instead. Don't count on a third delay. The 26.3.1 notes point to SAML, LDAP or another supported two-factor option, and the move touches your identity provider, group mappings and every rep's sign-in.

The Base 8.3.0 change matters for change control. Seamless critical patches now install without asking, and the appliance raises an alert when it can't reach the update server. If your firewall blocks that traffic, or your process says nothing changes outside a ticket, sort that out before you land on 26.2 or later.

On premises, upgrades come through /appliance under Updates, and Base packages normally go in right before the BeyondTrust package that needs them. BeyondTrust's own guidance for an appliance that's months or years behind is to install the available package and let it unlock the next one. If you aren't sure of the order, Support will work it out from a screenshot of /appliance > Status > Basics.

If BeyondTrust hosts your site, ask your account team which version it runs and when it moves. The end-of-support table doesn't split cloud from on-premises, and the RADIUS removal applies to both.

Staying supported is the main reason to move. A few changes are worth switching on while you're there, and none of them is needed on day one.

• Help desks with consent rules: RS 26.3.1 makes the user in an RDP session approve a rep before screen, files or shell open. BeyondTrust pitches it at GDPR and works council requirements.
• DBAs and audit: PRA 26.3.1 proxies Oracle database connections and injects credentials, so contractors use their own tools without ever seeing the password.
• Security operations: RS 26.2.1 can stream the appliance's own web, authentication and HAProxy logs to syslog (on-premises only, unstructured for now), so security teams get appliance-level logs without opening a support ticket.
• Identity teams: since 26.1.1 reps can use FIDO2 keys as a second factor. When the RADIUS tokens go, that's a better thing to hand people.
• Remote access teams: sign-in pages that ask for a username twice used to trip up PRA's credential injection. 26.3.1 handles them, and a Windows Gateway can show a client certificate to Entra-protected sites.
• Platform owners: Jump Client upgrades can roll out by Jump Group in 26.3.1, so you can test a small group of endpoints first.

# example output: fields from /appliance > Status > Basics, typed into the change record
Product:            Remote Support 24.3.x
Base software:      7.3.x
BT26-05-RS patch:   installed
Failover peer:      yes, same version
Security providers: LDAP, RADIUS
# RADIUS is listed, so plan the move to SAML before you take 27.1

We implement, upgrade and run privileged access platforms, and the BeyondTrust page lists what we cover. For this deadline we'd start with the version, Base and sign-in inventory, move reps off RADIUS, then run each hop with your team in booked windows. If you need engineers for the work, see BeyondTrust engineers for hire, or start with a free assessment.