EUVD-2026-41888
GHSA-8v46-5p7g-p46j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach appliance network endpoint
-
DeliverySend malformed client input
-
ExploitTrigger uncontrolled resource consumption
-
ExecutionCrash or exhaust communication subsystem
-
ImpactAppliance availability denied
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the BeyondTrust Remote Support or Privileged Remote Access appliance's network communication subsystem; per AV:N/AC:L/AT:N/PR:N/UI:N there is no authentication, no special configuration, and no user interaction required against a reachable appliance. The primary limiting factor is exposure scope: appliances confined to internal or management-only networks are only reachable by insiders, whereas internet-facing deployments (common for external remote-support use) are exploitable by any remote party. Impact is limited to availability of the appliance itself - no lateral compromise, data access, or code execution results from this flaw. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an easy, network-based, unauthenticated attack requiring no user interaction, which raises exploitability, but the impact is strictly availability (VC:N/VI:N/VA:H) - there is no data exposure or code execution. No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure is currently unquantified; the 8.7 score is driven by ease-of-access against a high-value appliance, not by severity of consequence. This is a genuine availability priority for internet-exposed appliances (a downed remote-support gateway can sever administrator access to an entire estate), but it is not a compromise/RCE-class emergency. Note: the input provides only a CVSS 4.0 vector and no SSVC decision data, so automatability and technical-impact framing beyond 'availability-only' cannot be independently confirmed. |
| Exploit ScenarioDerived | An attacker who can reach the appliance over the network sends crafted or malformed input to the pre-authentication network communication subsystem, exhausting resources or crashing the service and rendering the remote-support gateway unavailable. Because no authentication or user interaction is required (AV:N/PR:N/UI:N), the attack can be launched repeatedly from anywhere with connectivity to keep the appliance offline. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 06, 2026
Denial-of-service in BeyondTrust Remote Support and Privileged Remote Access appliances lets an unauthenticated remote attacker exhaust or crash the network communication subsystem, taking the appliance offline. The flaw is pre-authentication and network-reachable (CVSS 4.0 8.7, availability-only impact), but affects availability only - no confidentiality or integrity loss. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory BT26-03 (https://www.beyondtrust.com/trust-center/security-advisories/bt26-03) - apply the vendor-supplied update for both Remote Support and Privileged Remote Access; consult the advisory for the exact fixed version, which is not enumerated in the available input. As compensating controls until patching, restrict network reachability of the appliance's communication endpoints to trusted management/broker networks and place the appliance behind an upstream reverse proxy, WAF, or firewall that can rate-limit and validate inbound connections (trade-off: legitimate remote clients and external representatives may need allow-listing, which adds operational overhead). Monitor appliance availability and connection-rate metrics to detect resource-exhaustion attempts, and ensure high-availability/failover pairs are patched together to avoid a single crash disabling access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BeyondTrust Remote Support (formerly Bomgar) and Privileged Remote Access are enterprise remote-access and privileged-access-management appliances that broker inbound and outbound sessions over the network. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption): the appliance's network communication subsystem performs insufficient validation of client-supplied input, so a crafted request can drive the appliance to consume resources or enter a fault state before any authentication occurs. Per the CPE data, both cpe:2.3:a:beyondtrust:remote_support and cpe:2.3:a:beyondtrust:privileged_remote_access are affected across unspecified versions, indicating a shared communication component.
Know when Remote Support gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Unauthenticated, low-complexity, network-reachable pre-auth flaw (AV:N/AC:L/PR:N/UI:N) with availability-only impact (A:H; C:N/I:N) and no scope change.
Primary rating from Vendor (BT).
CVSS VectorVendor: BT
Lifecycle Timeline
2DescriptionCVE.org
BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.
Executive ViewAI
BeyondTrust Remote Support and Privileged Remote Access appliances are vulnerable to an unauthenticated denial-of-service attack that can take the appliance offline, disrupting critical privileged access management and remote support capabilities. This availability impact directly affects IT operations' ability to manage administrative access and support critical systems. Organizations should immediately identify affected deployments and implement interim protections while awaiting a vendor patch.
Until patch availability: (1) Implement network segmentation to restrict external access to appliance management interfaces; (2) Deploy rate-limiting on network endpoints to throttle potential DoS traffic; (3) Establish continuous monitoring and alerting for appliance availability and abnormal connection patterns; (4) Maintain documented manual procedures for credential management during appliance downtime; (5) Consider temporary redundant appliance deployment in separate network segments to ensure operational continuity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Remote Support
View allBeyondTrust Remote Support (RS) and older versions of Privileged Remote Access (PRA) contain a critical pre-authenticati
BeyondTrust Remote Support appliances contain an authentication bypass (CWE-290) in internal components that fail to val
Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which ca
Server-Side Template Injection (SSTI) vulnerability in the chat feature of Citrix Remote Support (RS) and Privileged Rem
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injectio
Authentication bypass in BeyondTrust Remote Support (and the related Privileged Remote Access product) lets an unauthent
Pre-authentication access-control bypass in BeyondTrust Remote Support and Privileged Remote Access appliances lets a ne
Improper data-query neutralization (NoSQL injection) in the web application component of BeyondTrust Remote Support and
The agent in Bomgar Remote Support 15.2.x before 15.2.3, 16.1.x before 16.1.5, and 16.2.x before 16.2.4 allows DLL hijac
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacke
Exploit-DB