Loading vulnerability…
Authentication bypass in BeyondTrust Remote Support and Privileged Remote Access
CVE-2026-40138 is a pre-authentication vulnerability in the authentication subsystem of BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) versions 25.3.2 and earlier. Improper validation of authentication data may allow an unauthenticated, network-positioned attacker to bypass access controls and gain unauthorized appliance access, including access to accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled; the exact configuration and technical exploitation mechanics have not been publicly specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may compromise appliance access controls and expose elevated-privilege accounts. Unauthorized access can put sensitive systems and data reachable through the remote-access platform at risk and potentially provide a foothold for pivoting into protected internal systems. Arbitrary code execution and denial of service are not specifically established for this vulnerability.
If you can’t patch tonight, do this now.
Until patching is complete, restrict appliance access to trusted administrative networks and reduce internet exposure. Review authentication settings and, subject to vendor guidance, disable the triggering authentication configuration if it can be identified and is unnecessary. Monitor authentication logs for anomalous privileged logins, unauthorized access, and new or modified administrator accounts. These measures do not replace the vendor update; no universally applicable vendor workaround is established.
Patch, then assume compromise.
Upgrade BeyondTrust Remote Support and Privileged Remote Access to version 25.3.3 or later, or apply the appropriate April 2026 Security Rollup for supported branches, following advisory BT26-03. Self-hosted deployments require installation or verification of these updates. BeyondTrust patched cloud-hosted RS and PRA instances automatically on April 21, 2026.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.