VendorsIT management, Security
BeyondTrust
BeyondTrust makes privileged access management software, including Remote Support (formerly Bomgar) and Privileged Remote Access, offered as cloud and self-hosted appliances.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- 15 Oct 2026
- Incidents on record
- 4
Response to exploited bugs
81 range 71–91rank 4 of 10
Provisional 4 reviewed zero-days. Not enough yet for a firm grade.
Fixing privately reported bugs
Not rated. No private reports in the grading window.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: B+ (81), provisional, from 4 reviewed zero-days in the last 36 months. Likely range 71 to 91.
- First fix within a day for all 4 zero-days.
- Every supported version fixed within a day for all 4 zero-days.
- First advisory within a day for all 4 zero-days.
- Fixing privately reported bugs: not rated. No private reports in the last 36 months.
Response to exploited bugs: sub-scores
- Time to first advisory4 of 4 zero-days within a day83B+4 cases, low confidence, weight 20%
- Time to first fix4 of 4 zero-days within a day84B+4 cases, low confidence, weight 40%
- Time to fix all versions4 of 4 zero-days within a day84B+4 cases, low confidence, weight 30%
- OpennessNo machine-readable advisory feed listed. 1 of 1 zero-day with a dated revision history. 2 of 2 advisories said the bug was exploited. 4 of 4 fixed zero-days with a public fix date for every version.54D+6 cases, medium confidence, weight 10%
Fixing privately reported bugs: sub-score
- Private fix speedNo private reports in the last 36 monthsNR0 cases, not used
Response fingerprint
Median of 4 graded zero-days. Vendor statement 0h, first fix 0h, all versions 0h.
Counts toward the response grade 4
- 15 Oct 2026BeyondTrust Remote Support improper origin validation (BT26-05)
- 6 Feb 2026BeyondTrust Remote Support and Privileged Remote Access pre-authentication remote code execution (BT26-02)
- 18 Dec 2024BeyondTrust Remote Support and Privileged Remote Access admin command injection (BT24-11)
- 16 Dec 2024BeyondTrust Remote Support and Privileged Remote Access unauthenticated command injection (BT24-10)
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
4 in 24 months, 1 with known ransomware use, 100% exploited before a fix
| First report | Incident | CVSS | Silence | First fix | All fixed | Status | Grade |
|---|---|---|---|---|---|---|---|
| 15 Oct 2026 | BeyondTrust Remote Support improper origin validation (BT26-05)CVE-2026-102764 | 9.3 | same day | same day | same day | Fixed | Counts toward grade |
| 6 Feb 2026 | BeyondTrust Remote Support and Privileged Remote Access pre-authentication remote code execution (BT26-02)CVE-2026-1731 | 9.9 | same day | same day | same day | Fixed | Counts toward grade |
| 18 Dec 2024 | BeyondTrust Remote Support and Privileged Remote Access admin command injection (BT24-11)CVE-2024-12686 | 6.6 | same day | same day | same day | Fixed | Counts toward grade |
| 16 Dec 2024 | BeyondTrust Remote Support and Privileged Remote Access unauthenticated command injection (BT24-10)CVE-2024-12356 | 9.8 | same day | same day | same day | Fixed | Counts toward grade |
Private reports
None in the window
Bugs reported privately to BeyondTrust by ZDI or Project Zero.
No privately reported cases from ZDI or Project Zero in the window.
Grade history
Response to exploited bugs: score at the end of each month.
Show as a table
| Month | Score | Grade |
|---|---|---|
| Nov 2025 | – | NR |
| Dec 2025 | – | NR |
| Jan 2026 | – | NR |
| Feb 2026 | 80 | B |
| Mar 2026 | 80 | B |
| Apr 2026 | 79 | B |
| May 2026 | 79 | B |
| Jun 2026 | 79 | B |
| Jul 2026 | 79 | B |
| Aug 2026 | 78 | B |
| Sep 2026 | 78 | B |
| Oct 2026 | 81 | B+ |
Channels
Get BeyondTrust's own alerts
- XBeyondTrust on XFollow the account and turn on notifications.
- Advisory pageBeyondTrust Trust Center security advisoriesCheck the advisory page. It has no push channel.
What we watch
We don't poll this vendor's channels yet. Incidents come from public sources.
See sources and health for when each was last read.
Grade B plus.