Critical Authentication Bypass Flaws Hit BeyondTrust Remote Support and PRA

BeyondTrust disclosed multiple vulnerabilities affecting Remote Support and Privileged Remote Access appliances, including two critical pre-authentication authentication-bypass flaws tracked as CVE-2026-40138 and CVE-2026-40139. Both issues carry CVSS 9.2 ratings and can allow remote attackers to gain unauthorized access, including access to elevated-privilege accounts, when a specific authentication configuration is enabled. A separate pre-authentication flaw, CVE-2026-40140, was rated CVSS 8.7 and can be exploited remotely to cause a denial-of-service condition in the network communication subsystem.

BeyondTrust also addressed CVE-2026-40141, a CVSS 8.5 vulnerability in a web application component that could let an authenticated low-privilege user access resources or data outside their intended authorization scope. The affected products are Remote Support 25.3.2 and earlier and Privileged Remote Access 25.3.2 and earlier. The Canadian Centre for Cyber Security urged administrators to review BeyondTrust’s advisory, apply vendor updates, disable the affected authentication configuration where possible, and review access controls and permissions.