BeyondTrust Patches Critical Auth-Bypass Flaws in Remote Support and PRA

Why it matters

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) are enterprise appliances that sit on the critical path to privileged credentials and remote administration of IT infrastructure. Two of the four newly disclosed flaws are pre-authentication auth-bypass vulnerabilities rated CVSS 9.2 that, under specific configurations, let a network-positioned or unauthenticated attacker seize the appliance with elevated privileges. Because prior RS/PRA flaws (CVE-2024-12356, CVE-2026-1731) were repeatedly exploited in the wild to deploy web shells and backdoors, defenders should treat rapid patching as a priority even though no active exploitation of these CVEs has been reported yet.

What happened

BeyondTrust released security advisory BT26-03 addressing four vulnerabilities discovered during internal security assessments supported by AI models including Anthropic Claude Opus 4.8 and proprietary tooling. The flaws affect Remote Support and Privileged Remote Access products:

• CVE-2026-40138 (CVSS 9.2) — pre-auth vulnerability in the authentication subsystem; improper validation of authentication data enables a network-positioned attacker to bypass access controls and reach elevated accounts.
• CVE-2026-40139 (CVSS 9.2) — pre-auth vulnerability in the authentication subsystem; improper processing of authentication requests lets an unauthenticated remote attacker bypass access controls.
• CVE-2026-40140 (CVSS 8.7) — pre-auth DoS in the network communication subsystem via insufficient validation of client-supplied input.
• CVE-2026-40141 (CVSS 8.5) — authenticated web-app flaw allowing a low-privileged user to access resources beyond their authorization scope.

Technical details

The two most severe issues (CVE-2026-40138 and CVE-2026-40139) live in the authentication subsystem of RS/PRA and require a specific authentication configuration to be enabled for exploitation. CVE-2026-40140 is a remotely triggerable denial-of-service affecting appliance availability, while CVE-2026-40141 is restricted to authenticated users holding particular permissions. BeyondTrust confirms no evidence of in-the-wild exploitation for these specific CVEs, but the product line has a history of being targeted for persistent access via web shells and backdoors. Affected versions are RS 25.3.2 and lower and PRA 25.3.2 and lower; fixes ship in RS 25.3.3 and PRA 25.3.3 and above.

Defender actions

• Upgrade BeyondTrust Remote Support to 25.3.3+ and Privileged Remote Access to 25.3.3+ immediately, prioritizing internet-exposed appliances.
• Inventory all RS/PRA deployments and confirm current version against the 25.3.2-or-lower affected range.
• Review appliance access logs for anomalous authentication, unexpected administrative sessions, or signs of web-shell/backdoor activity tied to prior RS/PRA exploitation patterns.
• If immediate patching is not possible, restrict network exposure of RS/PRA management interfaces and enforce MFA/strong authentication configurations as a mitigating control.