Loading vulnerability…
Authenticated authorization bypass in BeyondTrust Remote Support and Privileged Remote Access
CVE-2026-40141 affects a web application component of BeyondTrust Remote Support and Privileged Remote Access versions 25.3.2 and earlier. Insufficient validation of certain user-supplied input parameters can allow an authenticated attacker with limited privileges and specific permissions to access resources or data outside their intended authorization scope. The specific vulnerable function, parameters, and required permissions are not identified. The vulnerability is fixed in version 25.3.3 and later and through the applicable April 2026 Security Rollup for supported branches.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can bypass authorization boundaries and expose restricted resources or data to an authenticated, limited-privilege account. Sensitive information disclosure is possible. Code execution, data modification, and denial of service are not specifically established for this vulnerability.
If you can’t patch tonight, do this now.
Review and restrict user permissions according to least-privilege principles, particularly permissions that enable access to the affected web application functionality. Reduce internet exposure of the appliances and monitor logs for unauthorized access and privilege escalation activity. These measures do not replace installation of the security updates.
Patch, then assume compromise.
Upgrade BeyondTrust Remote Support and Privileged Remote Access to version 25.3.3 or later, or apply the applicable April 2026 Security Rollup for the supported branch. Self-hosted deployments require installation of these updates. BeyondTrust stated that all cloud-hosted RS and PRA instances were patched on April 21, 2026.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.