Remote Support and Privileged Remote Access
CVE-2026-40138: Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access
A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Remote Support 0 to 25.3.2 | Upgrade past 25.3.2; see the advisory |
| Privileged Remote Access 0 to 25.3.2 | Upgrade past 25.3.2; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.