Free tools Windows power users keep installed
One-click scans. No signup required.
Short answer: identify the exact BeyondTrust product, build, deployment model, update status and internet exposure; match those facts to the vendor’s security advisory; apply the fixed release (or a clearly temporary mitigation), verify the result, and preserve an evidence trail. Internet-facing, self-hosted systems that may have been exposed during an active exploitation window require immediate patching and a Severity 1 support escalation.
Start with a precise exposure record
A BeyondTrust advisory applies to a particular product, release family, deployment model and sometimes an enabled feature. A scanner finding by itself does not establish that your appliance is vulnerable or that it has reached the fixed build. Before deciding what to do, record the following for every potentially affected instance.
As an Amazon Associate I earn from qualifying purchases.
| Record | What to capture | Why it matters |
|---|---|---|
| Product | Exact product name, such as Remote Support (RS), Privileged Remote Access (PRA) or Privilege Management for Windows | Advisories can cover different products under separate fixed-version tables. |
| Version and build | Full appliance, server or client version, including all four-part build numbers where shown | Patch decisions depend on the affected and fixed build ranges, not only a major version. |
| Deployment model | SaaS or self-hosted/on-premises | Update delivery and administrator responsibility differ. |
| Update service | Whether automatic updating is enabled and when the last successful update occurred | A SaaS instance may already have received a vendor-deployed fix; a self-hosted instance normally requires an administrator to download and apply it. |
| Exposure | Internet-facing address, reverse proxy or firewall path, exposure dates and any access restrictions | BT26-02 specifically prioritizes internet-facing, self-hosted systems that remained unpatched. |
| Feature state | Whether the feature named by the advisory is enabled and how it is configured | Some mitigations work by disabling or restricting the affected feature. |
Export or screenshot the page that displays the running version before changing it. Include the host name or appliance identifier and the time collected. This makes later validation and incident review much easier.
Use the advisory catalog as the decision authority
BeyondTrust’s Security Advisories catalog is the authoritative starting point. The current catalog lists advisories from BT26-05 through BT24-01 and identifies each issue with its CVE, severity, CVSS score, affected products and public date. The catalog changes as new notices are published, so check it again whenever you open a remediation ticket.
#1 Best Overall
- Search the catalog for the CVE, advisory ID or product name.
- Open the individual advisory and read the affected-version and fixed-version tables for your deployment model.
- Confirm that the release you plan to install is explicitly listed as fixed. Do not infer a fixed build from a scanner’s generic “patched” result.
- Read the exploitation, mitigation and upgrade notes, including any conditions such as an enabled update service or a specific feature configuration.
- Save the advisory ID, CVE, publication date and the relevant fixed-version line in your change or vulnerability record.
For example, CVE-2024-12356 is listed with a CVSS score of 9.8 in BT24-10. That score is the vendor’s rating for that advisory; it is not a universal risk score for every BeyondTrust installation. Apply the same product, version and exposure checks to every CVE in the catalog.
Follow a patch workflow that works for both SaaS and self-hosted systems
1. Compare your build with the advisory
Write down the running build and the first fixed build shown in the advisory. If your release is outside the affected range, document why it is not affected rather than closing the ticket on a scanner result alone. If the build is affected, continue to deployment planning.
2. Determine who delivers the update
Applicable SaaS instances can receive a vendor-deployed patch when the update service is enabled. Self-hosted customers are generally instructed to download and apply the update themselves. BT26-02 and BT25-04 both distinguish these paths; automatic updating should never be assumed for an on-premises appliance.
3. Plan service impact and rollback evidence
Schedule the change under your organization’s maintenance process, notify support users, and capture a configuration backup or export if your platform’s procedures require one. Record the planned build, administrator, start time and validation checks. The advisories do not provide a universal remediation-time estimate, so your window must reflect your own change controls and service dependencies.
4. Apply the vendor-recommended release
Use the package and procedure specified in the advisory for your product and deployment model. Do not substitute a similarly named release from another product line. For SaaS, confirm the instance shows the vendor update completed; for self-hosted systems, verify the package checksum and installation result according to your normal software-change controls.
5. Verify and close only with evidence
After the update, record the new full build, update completion time, relevant feature settings and a test that the service is operating. Retain the advisory ID and change-ticket reference. If the fixed build cannot yet be installed, document the temporary mitigation, its owner, an expiry or review date and the planned patch date.
SaaS and self-hosted response are not interchangeable
| Deployment | Update behavior described by BeyondTrust | Administrator action | Evidence to retain |
|---|---|---|---|
| SaaS with update service enabled | For BT26-02, patches were issued and automatically deployed to applicable RS/PRA SaaS instances on February 2, 2026. | Confirm the instance received the update, capture its resulting version and review exposure history. | Instance identifier, displayed fixed build, update timestamp and validation result. |
| Self-hosted RS or PRA | Customers are directed to download and apply the recommended update; BT25-04 likewise directs on-premises customers to patch when automatic updates are not enabled. | Install the exact fixed release from the advisory and validate externally reachable services. | Package or change record, pre- and post-patch builds, configuration and test results. |
| Privilege Management for Windows clients | BT25-05 states that customers can push version 25.4.270.0 to clients to remediate the issue. | Deploy the client release through your endpoint-management process and check policy and registry conditions described in the advisory. | Deployment scope, client compliance result and policy change record. |
BT26-02 and CVE-2026-1731: treat possible internet exposure as urgent
BeyondTrust rates CVE-2026-1731 at CVSS 9.9 in BT26-02. The advisory says initial exploitation attempts were observed on February 10, 2026, and that exploitation was limited to internet-facing, self-hosted environments that were still unpatched as of February 9, 2026. Those dates define the advisory’s stated exposure window; they do not prove compromise or rule it out outside that window.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
BeyondTrust states that applicable SaaS RS/PRA instances with update service enabled received patches automatically on February 2. A self-hosted customer that had an internet-exposed instance still unpatched on February 9 should act immediately even if no suspicious activity is yet visible.
- Remove unnecessary public exposure or restrict access at the edge while preserving the evidence needed for investigation.
- Apply the recommended BT26-02 update immediately, using the self-hosted procedure and fixed release named in the advisory.
- Open a Severity 1 BeyondTrust support ticket and cite BT26-02 in the description, as the advisory requests for affected internet-exposed self-hosted customers.
- Preserve appliance, proxy, firewall, authentication and administrative-access logs covering the exposure period. Record who collected each source and when.
- Review access activity with your organization’s incident-response process. Look for unexpected logins, new accounts, configuration changes, session activity and outbound connections, but do not treat the absence of one indicator as proof that the system was untouched.
- Document the fixed build, the time it was installed, the ticket number and the outcome of your log review.
The advisory is the authority for the patch instruction. The scope of any forensic investigation depends on your local logs, retention period and surrounding controls, so escalate to your incident-response team when evidence is incomplete or suspicious activity is found.
BT25-04: temporary controls for Remote Support Public Site exposure
BT25-04 provides fixed RS/PRA releases and also lists temporary Public Site mitigations for situations in which the patch cannot yet be applied. These controls reduce risk; they are not a replacement for installing the fixed release.
- Require SAML authentication. This changes the authentication path for the Public Site and can reduce exposure to the affected flow, but verify that all required support users can authenticate before enforcing it.
- Enable session keys. Confirm that the setting is active on the relevant site and that support procedures account for the additional key requirement.
- Disable the Representative List. This can affect how users select or reach representatives, so test the operational impact and inform the service desk.
- Disable Issue Submission Survey. Removing the survey changes the Public Site workflow; record the change so it can be restored deliberately after patching.
Apply only the mitigations that match your deployment and the advisory’s instructions. Record each setting before and after the change, assign an owner to remove the temporary controls, and continue toward the exact fixed RS/PRA release listed in BT25-04.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallBT25-05: harden Privilege Management for Windows while upgrading
BT25-05 addresses CVE-2025-2297, listed with a CVSS score of 7.2. BeyondTrust states that version 25.4.270.0 fixes the Windows elevation issue and that customers can push this version to clients.
Deploy the fixed client
- Identify endpoints running an affected client release and map them to the policy that controls challenge-response elevation.
- Push client version 25.4.270.0 or a later release approved by the advisory through your endpoint-management system.
- Confirm endpoint compliance and test a representative elevation workflow under the organization’s normal least-privilege controls.
Remove risky “forever” challenge-response entries
Before remediation, BeyondTrust advises avoiding “forever” challenge-response auto-elevation. Where business needs allow, change the policy so new requests do not create permanent cache entries. On each relevant Windows profile, inspect:
HKEY_USERS\[sid]\Software\Avecto\Privilege Guard Client\ChallengeResponseCache
Look for existing forever entries and handle them according to your change and endpoint-management procedures. The [sid] segment represents the user’s security identifier; use the actual SID in the registry path rather than entering the brackets literally. If a business workflow genuinely requires persistent elevation, document the exception, its scope and compensating controls instead of silently leaving the setting unchanged.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Validate remediation and build an audit trail
A defensible closure record should allow another administrator to answer what was affected, what changed and how you know the fix is in place. Keep these fields together:
- Advisory ID and CVE.
- Product, deployment model and asset or instance identifier.
- Original full version and the evidence used to identify it.
- Internet exposure, including relevant dates and edge controls.
- Feature or policy state relevant to the advisory.
- Patch package or SaaS update confirmation, installation time and resulting full build.
- Any temporary mitigation, who approved it, and its review or removal date.
- Post-change validation result, including a service check and endpoint-compliance result where applicable.
- BeyondTrust support-ticket reference, especially for BT26-02 Severity 1 escalation.
- Log-review outcome and incident number when exploitation was possible or suspected.
Keep screenshots or exported reports only where they are permitted by your retention and privacy policies. Restrict sensitive logs and registry data to the responders who need them.
Choose between patching now and temporary risk reduction
| Situation | Immediate priority | What must still happen |
|---|---|---|
| Internet-facing self-hosted RS/PRA, unpatched during the BT26-02 window | Patch immediately, restrict exposure where practical and open a Severity 1 ticket citing BT26-02. | Preserve logs and complete an incident-response review. |
| Self-hosted Public Site cannot be patched in the maintenance window | Apply the BT25-04 temporary controls that fit your service. | Schedule and verify the exact fixed RS/PRA release; mitigations are temporary. |
| Privilege Management for Windows clients below the BT25-05 fix | Push 25.4.270.0 or later and stop creating new forever challenge-response entries. | Inspect the named registry cache and document approved exceptions. |
| Applicable SaaS instance with automatic updating enabled | Confirm the vendor update completed and the instance reports the fixed build. | Review historical exposure and retain the confirmation for audit. |
The right option depends on deployment model, exposure, operational impact, ability to verify the fixed build and the evidence your organization must retain. If those facts are uncertain, treat the instance as potentially affected until the advisory and local records establish otherwise.
Keep the process current
Assign ownership for monitoring the BeyondTrust advisory catalog, inventorying RS, PRA and Privilege Management for Windows versions, and reconciling new CVEs with those assets. A useful recurring check compares asset inventory to advisory IDs, confirms whether automatic updates are enabled, flags internet-facing self-hosted systems and verifies that exceptions have an owner and expiry date.
Recommended Free Tools
Recheck the catalog whenever a new BT advisory appears, after a major product upgrade and after any change to public access. Record the catalog review date and the person who performed it. This prevents a one-time patch from becoming a permanent assumption that every future release is covered.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
