CVE-2026-40138 — Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access

CVE-2026-40138

Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access PUBLISHED

Description (CNA)

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled

Affected (CNA)

Vendor / product	Versions
BeyondTrust / Remote Support	affected 0 through 25.3.2
BeyondTrust / Privileged Remote Access	affected 0 through 25.3.2

CWE

CWE-287

References

https://www.beyondtrust.com/trust-center/security-advisories/bt26-03

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.