CVE-2026-40139
Critical
Description
A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.
SeverityCritical
CVSS9.8
Exploit probability—
ProductBeyondtrust Remote Support
PublishedJul 6, 2026
First seenJul 6, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- beyondtrust remote_support25.3.3 or later
- beyondtrust privileged_remote_access25.3.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| beyondtrust remote_support | v < 25.3.3 | 25.3.3 |
| beyondtrust privileged_remote_access | v < 25.3.3 | 25.3.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.