CVE-2026-40138
High
Description
A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled
SeverityHigh
CVSS8.1
Exploit probability—
ProductBeyondtrust Privileged Remote Access
PublishedJul 6, 2026
First seenJul 6, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- beyondtrust privileged_remote_access25.3.3 or later
- beyondtrust remote_support25.3.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| beyondtrust privileged_remote_access | v < 25.3.3 | 25.3.3 |
| beyondtrust remote_support | v < 25.3.3 | 25.3.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.