BeyondTrust Remote Support CVE-2026-40138

The exploitation prerequisite is explicit: the target appliance must have the specific (non-default) authentication configuration enabled that the advisory references - without that mode active, the bypass does not apply, which is exactly why the CVSS carries AT:P (a present attack requirement) and AC:H. The attacker must be network-positioned to reach the appliance's authentication interface (AV:N), but no prior authentication or user interaction is required (PR:N/UI:N). Limiting factors that reduce realistic risk: the dependency on that particular authentication configuration, the elevated attack complexity, and network reachability - deployments that keep the appliance off the public internet or do not use the vulnerable auth mode are effectively not exposed.

Signals partly conflict, so prioritization needs care. The CVSS 4.0 base is 9.2 (Critical) with network vector and no privileges required (AV:N/PR:N/UI:N), which argues for urgent patching; however AC:H plus AT:P means the attack is not trivially automatable and depends on a present attack condition - namely the required non-default authentication configuration. There is no EPSS score, no KEV listing, and no identified public exploit, so there is currently no evidence of active or widespread exploitation; real-world risk today is elevated-but-conditional rather than mass-exploited. The decisive risk driver is exposure: internet-facing RS/PRA appliances running the vulnerable authentication mode are genuine high-priority targets given the privileged access they mediate, whereas instances without that configuration or without network exposure are materially lower risk. One tension to verify with the vendor: the description says exploitation 'requires a specific authentication configuration to be enabled,' which is why AT:P is set - defenders should confirm whether their deployment uses that mode before assuming full criticality.

An attacker who can reach an internet-facing BeyondTrust RS or PRA appliance that has the vulnerable authentication configuration enabled sends crafted authentication data that the subsystem fails to validate correctly, and is admitted without valid credentials. Because the bypass can yield elevated-privilege accounts, the attacker then leverages the appliance's privileged-access role to pivot toward the internal systems it manages. No public exploit is identified at time of analysis, and the AC:H/AT:P metrics indicate the attacker must satisfy specific conditions rather than fire a trivial one-shot request.