CVE-2026-40139

CriticalCVSS 9.8/10Last modified Jul 7, 2026

Description

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
BeyondTrust	Remote Support	<= 25.3.2
BeyondTrust	Privileged Remote Access	<= 25.3.2

References

https://www.beyondtrust.com/trust-center/security-advisories/bt26-03Vendor Advisory

Timeline

Published: Jul 6, 2026
Last modified: Jul 7, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-40149.8A security flaw has been discovered in itsourcecode Cafe Reservation System 1.0. This impacts an unknown function of the file /curvus2/signu CVE-2026-401407.5BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communicatio CVE-2026-401419.9A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to th CVE-2026-401447.3A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior CVE-2026-401457.1A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deployment) support utility and the agent's tampe CVE-2026-401486.5PraisonAI is a multi-agent teams system. Prior to 4.5.128, the _safe_extractall() function in PraisonAI's recipe registry validates archive CVE-2026-401497.3PraisonAI is a multi-agent teams system. Prior to 4.5.128, the gateway's /api/approval/allow-list endpoint permits unauthenticated modificat CVE-2026-40155.3A weakness has been identified in GPAC 26.03-DEV. Affected is the function txtin_process_texml of the file src/filters/load_text.c of the co CVE-2026-401506.5PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the web_crawl() function in praisonaiagents/tools/web_crawl_tools.py accept CVE-2026-401515.3PraisonAI is a multi-agent teams system. Prior to 4.5.128, the AgentOS deployment platform exposes a GET /api/agents endpoint that returns a CVE-2026-401525.3PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he list_files() tool in FileTools validates the directory parameter against CVE-2026-401536.5PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the execute_command function in shell_tools.py calls os.path.expandvars() o