BeyondTrust Remote Support CVE-2026-40141

The attacker must hold a valid, authenticated account on the BeyondTrust Remote Support or Privileged Remote Access web application, and that account must possess the specific permissions the advisory notes are required - the vulnerable code path is only reachable by accounts with those permissions. The exploitable behavior is insufficient validation of certain user-supplied input parameters processed by the web application component, allowing query manipulation (NoSQL/CWE-943) to reach data outside the account's authorization scope. Limiting factors: requires prior authentication (PR:L, not unauthenticated), requires the specific permission set (not any low-priv user), and is confined to the web application component; no user interaction or particular client platform is needed (UI:N, AV:N).

The vendor CVSS 4.0 base score is 8.5 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H - network-reachable, low complexity, no user interaction, but requiring low privileges (PR:L). The high subsequent-system impacts (SC:H/SI:H/SA:H) in the vendor vector suggest they judge that data reachable via injection can affect downstream systems, though the description itself emphasizes read/authorization-scope access, so I weight confidentiality more heavily than integrity/availability - this is a point to verify with the vendor. Mitigating factors are significant: exploitation requires a valid authenticated account 'with specific permissions,' which limits the attacker pool to insiders or those who have already compromised a scoped credential. No EPSS score, no KEV listing, and no POC are present in the provided data, so there is no evidence of active or automated exploitation. Net: a genuine priority for organizations exposing these consoles to many third-party/vendor users, but the PR:L requirement makes mass unauthenticated exploitation unlikely absent a chained authentication bypass.

A third-party vendor or contractor holding a limited BeyondTrust account with the relevant permission crafts malicious query operators inside a web request parameter. Because input is not neutralized before reaching the backend data query (NoSQL injection), the manipulated query returns session records, credentials metadata, or resources belonging to other tenants/scopes. Given AC:L and UI:N, the attack is repeatable and requires no victim interaction, though it does require the attacker to already be authenticated.