CVE-2026-40138

HIGH

BeyondTrust Remote Support and PRA - Unauthenticated Access Control Bypass

Title source: manual

Description

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled

References (1)

Core 1

Core References

https://www.beyondtrust.com/trust-center/security-advisories/bt26-03

Scores

CVSS v3 8.1

EPSS 0.0044

EPSS Percentile 36.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-287

Status published

Products (8)

BeyondTrust/Privileged Remote Access < 25.3.2

BeyondTrust/Privileged Remote Access < 25.3.3

BeyondTrust/Privileged Remote Access < 26.2.1

beyondtrust/privileged_remote_access < 25.3.3

BeyondTrust/Remote Support < 25.3.2

BeyondTrust/Remote Support < 25.3.3

BeyondTrust/Remote Support < 26.2.1

beyondtrust/remote_support < 25.3.3

Published Jul 06, 2026

Tracked Since Jul 06, 2026