CVE-2026-40138

Name of the Vulnerable Software and Affected Versions BeyondTrust Remote Support and Privileged Remote Access versions prior to 26.2.1 BeyondTrust Remote Support and Privileged Remote Access versions prior to 25.3.3

Description A critical pre-authentication flaw exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data allows a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled. Approximately 2,000 instances have been identified as exposed online.

Recommendations Upgrade to version 26.2.1. Upgrade to version 25.3.3. For self-hosted environments, apply the April security rollup.