CVE-2026-40138 Details
Description
A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled
A critical pre-authentication vulnerability has been identified in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. This vulnerability arises from improper validation of authentication data, which may enable a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation of this vulnerability requires a specific authentication configuration to be enabled.
A patch has been applied to all cloud customers as of April 21, 2026. Self-hosted customers should apply the April security rollup patch for the affected version if their instance is not subscribed to automatic updates, or upgrade to BeyondTrust Remote Support version 25.3.3 and above or Privileged Remote Access version 25.3.3 and above.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.beyondtrust.com/trust-center/security-advisories/bt26-03 | BeyondTrust | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | BeyondTrust |
Affected Products
| Product | Versions |
|---|---|
| beyondtrust privileged remote access | < 25.3.3 |
CPE
Remediation
| |
| beyondtrust remote support | < 25.3.3 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | CVE Modified | BeyondTrust |
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | BeyondTrust |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | BeyondTrust |