The BeyondTrust auth bypass vulnerability set covers four flaws in the Remote Support (RS) and Privileged Remote Access (PRA) products. A pre-authentication auth bypass is a flaw that lets an attacker skip login checks and reach protected functions without valid credentials. Two of the four fixes address exactly this. If exploited, they let unauthenticated attackers gain access to affected appliances, including accounts with elevated privileges. Privileged Remote Access (PRA) is a BeyondTrust appliance that brokers privileged sessions into internal environments. That perimeter position is why these bugs matter. BeyondTrust patched all four issues in version 25.3.3. Anything at 25.3.2 or lower is affected. Per the BeyondTrust advisory, the two critical flaws carry a CVSS score of 9.2.
How does the BeyondTrust auth bypass vulnerability work? The two most severe issues are CVE-2026-40138 and CVE-2026-40139. Both carry a CVSS score of 9.2. Both stem from improper handling of authentication data in the appliances' authentication subsystem. An attacker who reaches the appliance can skip login checks and act as an authenticated user. Per BeyondTrust, exploitation depends on a specific authentication configuration being enabled. That narrows the exposed population, but it doesn't remove the risk. These products have a documented history of active exploitation. CVE-2024-12356, for example, was used in real attacks. Given that record and the CVSS 9.2 rating, treat rapid patching to 25.3.3 as a priority.
Key takeaways
- BeyondTrust patched four vulnerabilities across Remote Support and Privileged Remote Access.
- CVE-2026-40138 and CVE-2026-40139 are critical pre-auth authentication bypass flaws rated CVSS 9.2.
- Exploitation of the two critical flaws hinges on a specific authentication configuration being enabled.
- Fixes are available in RS and PRA version 25.3.3 and above. Versions 25.3.2 and lower are affected.
- No in-the-wild exploitation is reported, but past RS/PRA flaws have been repeatedly exploited.
Affected
What happened
BeyondTrust has published updates for four security flaws in its Remote Support (RS) and Privileged Remote Access (PRA) appliances. The two most serious are pre-authentication vulnerabilities in the products' authentication subsystem. They could let attackers bypass access controls and reach accounts with elevated privileges.
How were the flaws found? BeyondTrust says it identified all four issues internally during ongoing security assessments. The work used publicly available AI models such as Anthropic's Claude Opus 4.8 alongside its own research tooling. Using AI models to surface vulnerabilities is a growing trend in security research. Here, it fits a wider shift toward vendor-driven, tool-assisted flaw discovery.
- Four vulnerabilities patched across RS and PRA
- Two critical flaws rated CVSS 9.2
The vulnerabilities
BeyondTrust detailed the four issues as follows:
- CVE-2026-40138 (CVSS 9.2): A pre-auth flaw in RS and PRA from improper validation of authentication data. A network-positioned attacker could bypass access controls and gain unauthorized access, including to privileged accounts.
- CVE-2026-40139 (CVSS 9.2): A pre-auth flaw in RS from improper processing of authentication requests. An unauthenticated remote attacker could bypass access controls and reach privileged accounts.
- CVE-2026-40140 (CVSS 8.7): A pre-auth flaw in the network communication subsystem from insufficient validation of client-supplied input. An unauthenticated remote attacker could trigger a denial-of-service condition affecting appliance availability.
- CVE-2026-40141 (CVSS 8.5): A flaw in a web application component of RS and PRA from insufficient validation of user-supplied input. An authenticated attacker with limited privileges could access resources beyond their authorization scope.
BeyondTrust noted that successful exploitation of CVE-2026-40138 and CVE-2026-40139 depends on a specific authentication configuration being enabled. Exploitation of CVE-2026-40141 is restricted to accounts with specific permissions.
Affected versions and fixes
BeyondTrust has addressed the issues in the following releases:
- Remote Support: RS 25.3.2 or lower is affected; fixed in RS 25.3.3 and above.
- Privileged Remote Access: PRA 25.3.2 or lower is affected; fixed in PRA 25.3.3 and above.
Patch promptly
BeyondTrust makes no mention of these flaws being exploited in the wild. But prior RS and PRA vulnerabilities (CVE-2024-12356 and CVE-2026-1731) have come under repeated exploitation to deploy web shells and backdoors. Apply the fixes quickly.
Why it matters
Why are these appliances targets? Remote Support and Privileged Remote Access appliances sit at the perimeter. They broker privileged access into internal environments, which makes them high-value targets. A successful pre-authentication bypass on such a device hands an attacker a foothold. That foothold comes with elevated privileges and no valid credentials.
Analysis: prior exploitation of BeyondTrust RS and PRA flaws underscores today's risk. CVE-2024-12356 was weaponized in real attacks soon after it surfaced. Attackers have a track record of moving fast on these products. Even without confirmed active exploitation of the new flaws, the critical severity and the appliances' privileged position warrant expedited patching. If you're an MSP exposing RS or PRA to the internet, put this at the top of the queue.
Timeline
Impact & actions
Unpatched RS and PRA appliances could allow unauthenticated access under specific configurations, denial of service, or unauthorized data access by limited-privilege users.
Security: Unauthenticated attackers could gain unauthorized access to appliances, including accounts with elevated privileges, under specific authentication configurations.
Recommended actions · High urgency
- 1Update BeyondTrust Remote Support and Privileged Remote Access to version 25.3.3 or later.
- 2Review appliance authentication configurations, particularly any settings that enable the affected authentication paths.
- 3Monitor appliances for signs of unauthorized access or web shell/backdoor activity given the products' exploitation history.
Technical details
- CVEs
- CVE-2026-40138, CVE-2026-40139, CVE-2026-40140, CVE-2026-40141
- CVSS
- 9.2
- Attack vector
- Network / pre-authentication for the two critical flaws (CVE-2026-40138, CVE-2026-40139)
- Affected versions
- Remote Support (RS) 25.3.2 and lower, Privileged Remote Access (PRA) 25.3.2 and lower
- Patched versions
- Remote Support (RS) 25.3.3 and above, Privileged Remote Access (PRA) 25.3.3 and above
Mitigations
- Upgrade to RS/PRA 25.3.3 or later.
- Review and restrict the authentication configuration required to exploit CVE-2026-40138 and CVE-2026-40139.
Response
Vendor
Customer guidance
BeyondTrust advises updating to RS and PRA 25.3.3 or above, where all four issues are fixed.
FAQ
Which BeyondTrust products are affected?
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) at version 25.3.2 or lower are affected.
How do I fix the vulnerabilities?
Update RS and PRA to version 25.3.3 or above, which BeyondTrust says addresses all four issues.
Are these flaws being exploited in the wild?
BeyondTrust makes no mention of active exploitation. But past flaws in RS and PRA products have been repeatedly exploited, so prompt patching is advised.
What makes CVE-2026-40138 and CVE-2026-40139 critical?
Both are pre-authentication flaws rated CVSS 9.2. They could let unauthenticated attackers bypass access controls and reach accounts with elevated privileges. Exploitation depends on a specific authentication configuration being enabled.
The bottom line
BeyondTrust patched four RS and PRA vulnerabilities in version 25.3.3, including two critical CVSS 9.2 pre-authentication auth bypass flaws.
What happens next
What to do
