Which versions of BeyondTrust Remote Support are affected by CVE-2026-40139?

BeyondTrust Remote Support and Privileged Remote Access contain a critical authentication bypass (CVE-2026-40139, CVSS 9.2) allowing remote attackers to gain unauthorized access as arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-40139?

24 hours: Inventory all BeyondTrust Remote Support and Privileged Remote Access deployments; contact BeyondTrust support to identify whether your versions are affected and if the vulnerable authentication configuration is enabled in your environment. 7 days: For systems with the vulnerable configuration active, implement network-level access controls (IP whitelisting, VPN requirement) restricting direct appliance access; enable comprehensive audit logging of all authentication and privileged account activity. 30 days: Establish a formal monitoring process for BeyondTrust security advisories; prepare a patch testing plan and deployment timeline for immediate execution once vendor patch becomes available.

BeyondTrust Remote Support CVE-2026-40139

Q: What is the CVSS score of CVE-2026-40139?

CVE-2026-40139 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-41887 CRITICAL

Improper Authentication (CWE-287)

2026-07-06 BT

GHSA-5wv8-v74x-qrjc

Authentication Bypass Privileged Remote Access Remote Support Beyondtrust

9.2

CVSS 4.0 · Vendor: BT

Severity by source

Vendor (BT) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Remote unauthenticated (AV:N/PR:N/UI:N) with full CIA impact; AC:H reflects the required non-default authentication configuration mapped from the 4.0 AT:P attack requirement.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (BT).

CVSS VectorVendor: BT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 06, 2026 - 18:02 EUVD

Analysis Generated

Jul 06, 2026 - 17:04 vuln.today

CVE Published

Jul 06, 2026 - 16:13 cve.org

CRITICAL 9.2

DescriptionCVE.org

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

AnalysisAI

Authentication bypass in BeyondTrust Remote Support (and the related Privileged Remote Access product) lets an unauthenticated remote attacker defeat access controls in the appliance's authentication subsystem and log in as arbitrary accounts, including highly privileged ones. Rated CVSS 4.0 9.2 (critical) and tracked as CWE-287 (Improper Authentication), the flaw is pre-authentication and network-reachable but is gated by a specific authentication configuration being enabled, reflected in the vector's Attack Requirements (AT:P). No public exploit identified at time of analysis, and the issue is not on CISA KEV.

Technical ContextAI

BeyondTrust Remote Support is an enterprise remote-access/PAM appliance used by help desks and privileged operators to establish attended and unattended sessions into managed endpoints; Privileged Remote Access (also listed in the CPE data) is its adjacent vaulting/least-privilege access product and shares the affected authentication subsystem. The root cause is CWE-287 Improper Authentication: the appliance improperly processes authentication requests, so the server-side logic that validates identity and enforces access controls can be subverted rather than a memory-safety or injection bug. Per the CPE strings (cpe:2.3:a:beyondtrust:remote_support:*:* and cpe:2.3:a:beyondtrust:privileged_remote_access:*:*), the defect lives in the appliance software itself, and because it sits in the login/authorization path a successful bypass yields legitimate-looking sessions, including elevated accounts, without triggering credential-based controls.

RemediationAI

Apply the fixed appliance release identified in BeyondTrust security advisory BT26-03 (https://www.beyondtrust.com/trust-center/security-advisories/bt26-03) - patch available per vendor advisory, but no exact fixed version was provided in the input data, so confirm the target build directly from BT26-03 before upgrading. As an immediate compensating control until patched, disable the specific authentication configuration that the advisory identifies as the exploitation prerequisite (the flaw only triggers when that configuration is enabled); the trade-off is loss of whatever authentication feature that setting provides, so validate against your SSO/identity integration before disabling. Additionally, restrict network reachability of the appliance's authentication/login interface to trusted management networks or VPN and place it behind a WAF/reverse proxy, accepting that this reduces convenience for remote operators and any external/partner access. Monitor authentication and session logs for anomalous logins to privileged accounts.