by Kastro
Paper/Archive/CVE-2026-40138

CVE-2026-40138

BeyondTrust Remote Support — Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access

EPSS 0.5%CVSS 9.2
critical.is priorityof 100
36
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 39.8.398 × 208.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled

Affected

ProductAffectedFixed inSource
Remote Support≤ 25.3.2–CNA
Privileged Remote Access≤ 25.3.2–CNA

Scores by source

BT (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refbeyondtrust.com/trust-center/security-advisories/bt26-03