Is there a public PoC exploit available for CVE-2026-40138?

Yes, a public proof-of-concept exploit is available for CVE-2026-40138. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2026-40138?

Yes, a patch is available for CVE-2026-40138. Update the affected software to the latest version immediately.

BeyondTrust Remote Support CVE-2026-40138

Q: What is the CVSS score of CVE-2026-40138?

CVE-2026-40138 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41886 CRITICAL

Improper Authentication (CWE-287)

2026-07-06 BT

GHSA-hcrc-2pw3-4v88

Authentication Bypass Privileged Remote Access Remote Support Beyondtrust

9.2

CVSS 4.0 · Vendor: BT

Severity by source

Vendor (BT) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network pre-auth bypass (AV:N/PR:N/UI:N) but gated by a required non-default auth configuration, so AC:H; full appliance compromise gives C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (BT).

CVSS VectorVendor: BT

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 06, 2026 - 18:02 EUVD

CVE Published

Jul 06, 2026 - 17:10 cve.org

CRITICAL 9.2

Analysis Generated

Jul 06, 2026 - 17:02 vuln.today

DescriptionCVE.org

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled

AnalysisAI

Pre-authentication access-control bypass in BeyondTrust Remote Support and Privileged Remote Access appliances lets a network-positioned attacker abuse improper authentication-data validation to reach the appliance and take over accounts, including privileged ones. Exploitation only works when a specific authentication configuration is enabled, and success requires overcoming meaningful attack conditions (CVSS 4.0 AC:H/AT:P). No public exploit has been identified at time of analysis and it is not on CISA KEV, but the pre-auth nature and privileged-access role of these appliances make it high-priority for internet-exposed deployments.

Technical ContextAI

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) are enterprise appliances that broker remote screen-sharing, support sessions, and privileged access to internal systems, so their authentication subsystem is a high-value gatekeeper. The flaw is classed as CWE-287 (Improper Authentication): the authentication subsystem does not correctly validate authentication data, so an attacker can present crafted or manipulated credentials/tokens and be treated as a legitimate - even elevated - principal. The affected CPEs are cpe:2.3:a:beyondtrust:remote_support and cpe:2.3:a:beyondtrust:privileged_remote_access (both listed with version wildcards, so exact fixed builds must be confirmed against the vendor advisory). Because these products sit at the front of privileged-access workflows, an authentication bypass effectively hands an attacker the keys to the downstream managed systems.

RemediationAI

Apply the fix described in BeyondTrust security advisory BT26-03 (https://www.beyondtrust.com/trust-center/security-advisories/bt26-03); the input does not name an exact fixed version, so treat this as patch available per vendor advisory and update to the vendor-designated patched build once confirmed. As an interim compensating control, identify and disable the specific authentication configuration/mode that the advisory flags as the exploitation prerequisite - this directly removes the attack condition, though it may disrupt whatever SSO/federation or auth workflow relies on that mode, so validate login paths afterward. Additionally, restrict network reachability of the RS/PRA appliance's authentication endpoints to trusted management networks or VPN (removing direct internet exposure), which blocks the network-positioned attacker at the cost of remote-access convenience for external support staff. Review appliance and privileged-session logs for anomalous authentications during the exposure window.