Loading vulnerability…
Authentication bypass in BeyondTrust Remote Support
CVE-2026-40139 is a pre-authentication vulnerability in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass authentication and access controls and gain unauthorized appliance access, potentially including elevated-privilege accounts. Exploitation requires a specific authentication configuration to be enabled. Remote Support versions 25.3.2 and earlier are affected; version 25.3.3 and later includes the fix.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may compromise appliance access controls and expose elevated-privilege accounts. Unauthorized access to sensitive systems and data is also identified as a potential consequence of the authentication-bypass flaws CVE-2026-40138 and CVE-2026-40139, although the extent of data access attributable specifically to CVE-2026-40139 is not detailed.
If you can’t patch tonight, do this now.
Until patching is completed, restrict appliance access to trusted administrative networks and reduce internet exposure. Review authentication settings and disable the configuration required for exploitation if it can be identified through vendor guidance and safely disabled. The exact configuration is not specified in the available information. Monitor for suspicious authentication, unauthorized access, and privilege-escalation activity.
Patch, then assume compromise.
Upgrade self-hosted BeyondTrust Remote Support to version 25.3.3 or later, or apply the appropriate April 2026 Security Rollup for the supported release branch under advisory BT26-03. Cloud-hosted instances were automatically patched on April 21, 2026. Applicability to Privileged Remote Access is inconsistently identified; verify its product-specific exposure and required updates against BT26-03.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.