Auth bypass in Beyondtrust Privileged Remote Access
CVE-2026-40139
A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.
Vulnerability class: Broken Authentication
EPSS: 0.007 (49.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- 13061848-ea10-403d-bd75-c83a022c2891 (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-40139?
- CVE-2026-40139 is a critical-severity vulnerability in Beyondtrust Privileged Remote Access, classified under Improper Authentication. CVSS score: 9.8/10. Published 2026-07-06.
- How severe is CVE-2026-40139?
- Critical severity. CVSS v3 base score is 9.8 out of 10.