Loading story…
BeyondTrust disclosed two high-severity local vulnerabilities in Endpoint Privilege Management (EPM) for Windows that affect Windows Deployment versions released before 26.1.2. The issues, tracked as CVE-2026-40144 and CVE-2026-40145, were detailed in advisory BT26-04 and echoed in alert AV26-826 from the Canadian Centre for Cyber Security, which urged organizations to review the vendor guidance and apply updates as they become available.
CVE-2026-40144 is a kernel-mode out-of-bounds read flaw that could allow a local non-admin user to corrupt kernel memory and execute arbitrary code in kernel mode, potentially taking full control of an endpoint. CVE-2026-40145 is an insufficient access-control issue in an EPM support utility tied to anti-tamper protections that could let an already privileged local attacker run code outside the intended anti-tamper scope. BeyondTrust said both flaws were fixed in version 26.1.2 and reported no evidence of exploitation before remediation, while recommending prompt upgrades and monitoring for privilege-escalation activity, kernel crashes, suspicious EPM utility behavior, and attempts to disable endpoint security controls.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
On August 18, 2026, the Canadian Centre for Cyber Security published security advisory AV26-826 stating that BeyondTrust Endpoint Privilege Management for Windows was affected by vulnerabilities, with status current as of August 17, 2026. The notice directed users to review BeyondTrust advisory BT26-04 and apply updates as they become available.
BeyondTrust remediated CVE-2026-40144 and CVE-2026-40145 in Endpoint Privilege Management for Windows version 26.1.2. The fixes addressed a kernel-mode out-of-bounds read issue and an insufficient access-control flaw involving a support utility and anti-tamper protections.
On August 17, 2026, BeyondTrust published advisory BT26-04 disclosing two high-severity local vulnerabilities in Endpoint Privilege Management for Windows, tracked as CVE-2026-40144 and CVE-2026-40145. The company said the flaws affected Windows Deployment versions released before 26.1.2 and that it found no evidence of exploitation before remediation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BeyondTrust disclosed multiple vulnerabilities affecting **Remote Support** and **Privileged Remote Access** appliances, including two critical pre-authentication authentication-bypass flaws tracked as `CVE-2026-40138` and `CVE-2026-40139`. Both issues carry **CVSS 9.2** ratings and can allow remote attackers to gain unauthorized access, including access to elevated-privilege accounts, when a specific authentication configuration is enabled. A separate pre-authentication flaw, `CVE-2026-40140`, was rated **CVSS 8.7** and can be exploited remotely to cause a denial-of-service condition in the network communication subsystem. BeyondTrust also addressed `CVE-2026-40141`, a **CVSS 8.5** vulnerability in a web application component that could let an authenticated low-privilege user access resources or data outside their intended authorization scope. The affected products are **Remote Support 25.3.2 and earlier** and **Privileged Remote Access 25.3.2 and earlier**. The Canadian Centre for Cyber Security urged administrators to review BeyondTrust’s advisory, apply vendor updates, disable the affected authentication configuration where possible, and review access controls and permissions.
Jul 9, 2026
BeyondTrust disclosed and fixed **CVE-2026-1731**, a critical unauthenticated remote code execution flaw affecting **Remote Support 25.3.1 and earlier** and **Privileged Remote Access 24.3.4 and earlier**. The vulnerability allows a remote attacker to send crafted client requests and execute system commands on the target appliance as the **site user**, creating a path to full system compromise, data theft, and service disruption. CSIRT.SK reported the issue carries a **CVSS score of 9.9**. BeyondTrust said cloud instances were updated automatically, while organizations running on-premises deployments were told to upgrade to **Remote Support 25.3.2** and **Privileged Remote Access 25.1.1**, or apply the vendor patches **`BT26-02-RS`** and **`BT26-02-PRA`**. The advisory identifies the flaw as a high-priority risk for enterprises using BeyondTrust remote access and support platforms because exploitation requires no authentication and can result in command execution on exposed systems.
Jul 24, 2026
A critical **pre-authentication remote code execution** flaw in BeyondTrust Remote Support and some older versions of Privileged Remote Access, tracked as `CVE-2026-1731`, has been actively exploited against internet-facing systems. The bug is described as an unauthenticated operating system command injection vulnerability that lets attackers execute arbitrary commands on affected servers. BeyondTrust patched its SaaS customers on February 2 and urged self-hosted customers to apply fixes, while **CISA** added the vulnerability to its Known Exploited Vulnerabilities catalog and public exploit code later appeared on GitHub. Incident responders and threat researchers reported a rise in post-exploitation activity across multiple BeyondTrust customers in sectors including **financial services, technology, higher education, legal services, and healthcare**. Palo Alto Networks Unit 42 observed attackers deploying **SparkRAT** and **vShell** backdoors, using remote management and tunneling tools for reconnaissance and persistence, and in some cases conducting environment enumeration and suspected data theft. Censys and other researchers also warned that exposed BeyondTrust instances were reachable from the internet, underscoring the risk of rapid compromise where patches had not been applied.
Jun 29, 2026