Loading vulnerability…
Pre-authentication resource exhaustion in BeyondTrust Remote Support and Privileged Remote Access
CVE-2026-40140 is an uncontrolled resource consumption vulnerability in the network communication subsystem of BeyondTrust Remote Support and Privileged Remote Access versions 25.3.2 and earlier. Insufficient validation of client-supplied input allows an unauthenticated remote attacker to trigger resource exhaustion and a denial-of-service condition affecting appliance availability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disrupt the availability of affected Remote Support and Privileged Remote Access appliances through resource exhaustion, interrupting services provided by those appliances.
If you can’t patch tonight, do this now.
Restrict internet exposure of BeyondTrust appliances to reduce access to the vulnerable network communication subsystem. This exposure reduction does not replace installation of the vendor fixes.
Patch, then assume compromise.
Upgrade BeyondTrust Remote Support and Privileged Remote Access to version 25.3.3 or later, or apply the appropriate April 2026 Security Rollup for supported branches. Self-hosted customers must install these updates. BeyondTrust patched cloud-hosted RS and PRA instances on April 21, 2026.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.