Which versions of BeyondTrust Remote Support are affected by CVE-2026-40141?

BeyondTrust Remote Support and Privileged Remote Access contain a NoSQL injection vulnerability that allows authenticated users to bypass authorization controls and access sensitive data beyond their…. A patch is available.

How to fix or mitigate CVE-2026-40141?

Within 24 hours: Conduct inventory of all BeyondTrust Remote Support and Privileged Remote Access deployments; disable or restrict access to users not requiring active use. Within 7 days: Enable comprehensive database query logging with alerting for suspicious patterns; implement network-level access controls limiting application connectivity to authorized networks only; require multi-factor authentication for all administrative accounts. Within 30 days: Establish contact with BeyondTrust for patch availability timeline; deploy application firewall rules targeting NoSQL injection attack patterns; conduct access review to minimize low-privilege account permissions.

BeyondTrust Remote Support CVE-2026-40141

Q: What is the CVSS score of CVE-2026-40141?

CVE-2026-40141 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41889 HIGH

Improper Neutralization of Special Elements in Data Query Logic (CWE-943)

2026-07-06 BT

GHSA-v5xx-3hcf-fm67

Nosql Injection Information Disclosure Remote Support Privilege Remote Access

8.5

CVSS 4.0 · Vendor: BT

Severity by source

Vendor (BT) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Network-reachable web app, low complexity, but requires an authenticated permissioned account (PR:L); injection crosses an authorization boundary (S:C) to disclose data, so C:H with no integrity/availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (BT).

CVSS VectorVendor: BT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 06, 2026 - 18:02 EUVD

Analysis Generated

Jul 06, 2026 - 17:07 vuln.today

DescriptionCVE.org

A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated attacker with limited privileges to access unintended resources or data beyond their authorization scope. Exploitation is restricted to accounts with specific permissions.

AnalysisAI

Improper data-query neutralization (NoSQL injection) in the web application component of BeyondTrust Remote Support and Privileged Remote Access allows an authenticated, low-privileged attacker to manipulate input parameters and read resources or data beyond their authorization scope. The flaw enables information disclosure across authorization boundaries and, per the vendor's CVSS 4.0 vector, can impact downstream systems. No public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation is restricted to accounts holding specific permissions.

Technical ContextAI

The affected products are BeyondTrust Remote Support and Privileged Remote Access (CPE cpe:2.3:a:beyondtrust:remote_support and cpe:2.3:a:beyondtrust:privilege_remote_access), enterprise privileged-access/secure remote support appliances that broker vendor and administrator sessions into internal environments. The root cause is CWE-943, Improper Neutralization of Special Elements in Data Query Logic - the query-injection class that includes NoSQL injection (confirmed by the 'Nosql Injection' tag). User-supplied parameters are passed into backend data queries without sufficient validation, so crafted operators or query fragments alter query logic and return records the account was never authorized to see. The 'Information Disclosure' tag and description ('access unintended resources or data') indicate the primary security consequence is confidentiality loss rather than data destruction.

RemediationAI

Consult BeyondTrust Security Advisory BT26-03 (https://www.beyondtrust.com/trust-center/security-advisories/bt26-03) and apply the vendor-provided update for the affected Remote Support / Privileged Remote Access appliance version - the exact fixed version is not included in this dataset and should be taken directly from the advisory. Patch status: Patch available per vendor advisory (exact fix version not confirmed from available data). As compensating controls until patched, tighten account provisioning so only trusted users hold the 'specific permissions' required for exploitation and audit existing accounts for that permission set (trade-off: may temporarily reduce legitimate delegated functionality); restrict network reachability of the administrative/web console to management VLANs or VPN rather than the open internet (trade-off: affects remote vendor access workflows); and increase logging/monitoring on the web application component for anomalous query parameters and cross-scope data access.