What’s Vulnerable › Vulnerabilities
CVE-2026-40139: Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-06 · updated 2026-07-07
- Weakness: CWE-287
Description
A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.
Affected products
- BeyondTrust Privileged Remote Access: before 25.3.3 — fixed in 25.3.3
- BeyondTrust Remote Support: before 25.3.3 — fixed in 25.3.3
How to fix
Upgrade to a fixed version: BeyondTrust Privileged Remote Access 25.3.3; BeyondTrust Remote Support 25.3.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-40139 or the next vulnerability affects your stack