CVE-2026-40139

Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access

State: Published
Severity: 9.2 Critical
Published: Jul 6, 2026
Updated: Jul 7, 2026
Reserved: Apr 9, 2026

Description

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	BT

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
Remote SupportBeyondTrust	25.3.2 and earlierAffected
Privileged Remote AccessBeyondTrust	25.3.2 and earlierAffected

References

https://www.beyondtrust.com/trust-center/security-advisories/bt26-03

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.