Auth bypass in Beyondtrust Privileged Remote Access

CVE-2026-40139

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

Vulnerability class: Broken Authentication

EPSS: 0.007 (49.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-40139?
CVE-2026-40139 is a critical-severity vulnerability in Beyondtrust Privileged Remote Access, classified under Improper Authentication. CVSS score: 9.8/10. Published 2026-07-06.
How severe is CVE-2026-40139?
Critical severity. CVSS v3 base score is 9.8 out of 10.