CVE-2025-5309 is a critical server side template injection flaw (CVSS 9.8) in the chat feature of BeyondTrust Remote Support and Privileged Remote Access. It can lead to remote code execution. BeyondTrust documents the fix in security advisory BT25-04, so read it and apply the patch to every appliance.
What's affected
The record says the chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to server side template injection, which can lead to remote code execution. It classifies the weakness as CWE-94, code injection, with a network vector and no privileges or user interaction.
The record names both products and points to the BeyondTrust advisory BT25-04 for details. I could not load that page while preparing this article, so I will not quote affected or fixed version numbers. Read BT25-04 for the exact versions, for any difference between cloud and self hosted deployments, and for the patch steps.
BeyondTrust products are remote access tools with deep reach into customer networks, which raises the stakes for any flaw in them.
How to check if you're exposed
Find your BeyondTrust deployments and note whether each is a cloud service managed by the vendor or a self hosted appliance. The advisory BT25-04 explains what applies to each type, so open it first.
For a self hosted appliance, read the version from the administrative interface and compare it with the affected builds in the advisory. Check whether the appliance is reachable from the internet, since remote support tools usually must be, and note which people can use the chat feature.
Review the appliance logs for unusual chat activity and for any new accounts or settings you did not make. Keep the records until you finish your review.
What to do now
- Open BeyondTrust advisory BT25-04 and read the affected builds and fix instructions.
- Confirm whether each deployment is cloud or self hosted, and apply any patch that the advisory lists for self hosted systems.
- Restrict administrative access to the appliance to trusted networks where your design allows it.
- Review the appliance for unexpected accounts, API keys, scripts or configuration changes.
- If you find signs of misuse, follow your incident process and rotate the credentials the appliance holds.
Why it matters
Server side template injection happens when user input is placed inside a template that the server evaluates. The template engine treats parts of the input as instructions, and many engines can reach functions that run system commands. A chat box is an input that many users can reach, which is why the flaw is serious.
A remote access appliance usually holds credentials and network reach into customer systems, so it is a high value target. The record gives a 9.8 score and the CVE is not marked as known exploited in the CISA Known Exploited Vulnerabilities data in the record. That can change, so check the current status before you decide on timing. This is the kind of flaw where speed matters.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions are affected?
The record does not list them. BeyondTrust advisory BT25-04 has the affected builds and the patch.
Sources
Last reviewed: 18 October 2026.
