Which versions of BeyondTrust Remote Support are affected by CVE-2026-40140?

BeyondTrust Remote Support and Privileged Remote Access appliances are vulnerable to an unauthenticated denial-of-service attack that can take the appliance offline, disrupting critical privileged…. A patch is available.

How to fix or mitigate CVE-2026-40140?

Within 24 hours: Inventory all BeyondTrust Remote Support and Privileged Remote Access appliances and document current versions. Implement network-level rate limiting and access restrictions on management interfaces. Within 7 days: Contact BeyondTrust Support for interim mitigation guidance and patch timeline. Establish enhanced monitoring for abnormal network activity targeting the appliances. Within 30 days: Apply vendor patch when released (monitor BeyondTrust security advisories for exact version numbers), or execute documented manual access management procedures if patching cannot be expedited.

BeyondTrust Remote Support CVE-2026-40140

Q: What is the CVSS score of CVE-2026-40140?

CVE-2026-40140 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-41888 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-06 BT

GHSA-8v46-5p7g-p46j

Denial Of Service Privileged Remote Access Remote Support Beyondtrust

8.7

CVSS 4.0 · Vendor: BT

Severity by source

Vendor (BT) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated, low-complexity, network-reachable pre-auth flaw (AV:N/AC:L/PR:N/UI:N) with availability-only impact (A:H; C:N/I:N) and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (BT).

CVSS VectorVendor: BT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 06, 2026 - 18:02 EUVD

Analysis Generated

Jul 06, 2026 - 17:06 vuln.today

CVE Published

Jul 06, 2026 - 16:13 cve.org

HIGH 8.7

DescriptionCVE.org

BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.

AnalysisAI

Denial-of-service in BeyondTrust Remote Support and Privileged Remote Access appliances lets an unauthenticated remote attacker exhaust or crash the network communication subsystem, taking the appliance offline. The flaw is pre-authentication and network-reachable (CVSS 4.0 8.7, availability-only impact), but affects availability only - no confidentiality or integrity loss. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

BeyondTrust Remote Support (formerly Bomgar) and Privileged Remote Access are enterprise remote-access and privileged-access-management appliances that broker inbound and outbound sessions over the network. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption): the appliance's network communication subsystem performs insufficient validation of client-supplied input, so a crafted request can drive the appliance to consume resources or enter a fault state before any authentication occurs. Per the CPE data, both cpe:2.3:a:beyondtrust:remote_support and cpe:2.3:a:beyondtrust:privileged_remote_access are affected across unspecified versions, indicating a shared communication component.

RemediationAI

Patch available per vendor advisory BT26-03 (https://www.beyondtrust.com/trust-center/security-advisories/bt26-03) - apply the vendor-supplied update for both Remote Support and Privileged Remote Access; consult the advisory for the exact fixed version, which is not enumerated in the available input. As compensating controls until patching, restrict network reachability of the appliance's communication endpoints to trusted management/broker networks and place the appliance behind an upstream reverse proxy, WAF, or firewall that can rate-limit and validate inbound connections (trade-off: legitimate remote clients and external representatives may need allow-listing, which adds operational overhead). Monitor appliance availability and connection-rate metrics to detect resource-exhaustion attempts, and ensure high-availability/failover pairs are patched together to avoid a single crash disabling access.