CVE-2026-40138: BeyondTrust Pre-Authentication Bypass (Remote Support & Privileged Remote Access)

Technical summary

CVE-2026-40138 is a pre-authentication authentication bypass vulnerability (CWE-287) affecting the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. The vulnerability stems from improper validation of authentication data, allowing network-positioned attackers to circumvent access controls without valid credentials. The CVSS 3.1 score of 8.1 (HIGH) reflects high confidentiality, integrity, and authenticity impact with a network attack vector and high attack complexity, indicating the vulnerability is difficult but not impossible to exploit. A specific authentication configuration must be enabled for exploitation to succeed.

Business impact

Successful exploitation could result in complete compromise of the appliance, including unauthorized access to sensitive administrative functions and elevated-privilege accounts. Organizations using BeyondTrust for remote support or privileged access management face potential data exposure, lateral movement opportunities within managed infrastructure, and loss of control over privileged sessions. The reputational and operational impact is significant, as these products are often trusted for secure remote access to critical systems.

Affected systems

BeyondTrust Remote Support and BeyondTrust Privileged Remote Access are affected. The vulnerability is triggered only when a specific authentication configuration is enabled, so organizations should audit their deployment settings to determine exposure. Verify the exact affected versions and patch releases against BeyondTrust's official security advisory.

Exploitability

The vulnerability requires network access and a specific authentication configuration to be active, which raises the attack complexity to HIGH. However, no user interaction is required, and the attacker needs no pre-existing credentials. The barrier to exploitation is meaningful but not prohibitive for an attacker with network positioning and knowledge of the target environment. The vulnerability has not been added to the KEV catalog, indicating no known active exploitation in the wild at the time of publication.

Remediation

Apply patches from BeyondTrust for both Remote Support and Privileged Remote Access immediately upon availability. Verify the specific patched versions in BeyondTrust's security advisory. As an interim measure, review and restrict the authentication configuration settings mentioned in the vulnerability description to disable the affected configuration if operationally feasible, and implement network segmentation to limit access to the appliance from untrusted networks.

Patch guidance

Contact BeyondTrust support or monitor their security advisories for patched versions of Remote Support and Privileged Remote Access. Apply patches during a maintenance window after thorough testing in a non-production environment. Prioritize appliances exposed to untrusted networks or internet-facing deployments. Verify patch deployment and validate that the vulnerable authentication configuration is no longer exploitable post-patching.

Detection guidance

Monitor network traffic to BeyondTrust appliances for anomalous authentication attempts, especially patterns that bypass normal login workflows or succeed without valid credentials. Review appliance logs for failed authentication events followed by successful access with elevated privileges, or direct privilege escalation without a preceding successful authentication. Implement alerts for any authentication bypass indicators specific to the affected configuration setting. Consult BeyondTrust's detection guidance for indicators of compromise.

Why prioritize this

Although the CVSS score is 8.1 (HIGH) rather than CRITICAL, this vulnerability merits urgent attention because it is pre-authentication, allows direct access to sensitive privileged access management infrastructure, and affects both Remote Support and Privileged Remote Access products which are pervasive in enterprise environments. The high attack complexity and specific configuration requirement provide some tactical breathing room, but the lack of exploitation requirements (no user interaction, no pre-existing credentials) and the severity of potential impact make rapid patching essential for organizations running these products.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects a pre-authentication attack with network access (AV:N), high attack complexity due to the required specific configuration (AC:H), no privilege or user interaction requirements (PR:N/UI:N), and complete compromise of confidentiality, integrity, and authenticity (C:H/I:H/A:H). The unchanged scope (S:U) indicates the impact is limited to the vulnerable component. The HIGH severity is justified by the combination of pre-authentication access, potential privilege escalation, and the critical role of these products in enterprise access management.

Frequently asked questions