Auth bypass in Beyondtrust Privileged Remote Access
CVE-2026-40138
A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled
Vulnerability class: Broken Authentication
EPSS: 0.004 (37.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- 13061848-ea10-403d-bd75-c83a022c2891 (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-40138?
- CVE-2026-40138 is a high-severity vulnerability in Beyondtrust Privileged Remote Access, classified under Improper Authentication. CVSS score: 8.1/10. Published 2026-07-06.
- How severe is CVE-2026-40138?
- High severity. CVSS v3 base score is 8.1 out of 10.