Beyondtrust
19 CVEs across 23 Beyondtrust products. Browse Beyondtrust vulnerabilities, severities, and proof-of-concept exploits.
Beyondtrust products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-40141 | Critical | 9.9 | 2026-07-06 | A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of cer… |
CVE-2026-40140 | High | 7.5 | 2026-07-06 | BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insuff… |
CVE-2026-40139 | Critical | 9.8 | 2026-07-06 | A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication request… |
CVE-2026-40138 | High | 8.1 | 2026-07-06 | A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validat… |
CVE-2026-1731 | Critical | 9.8 | 2026-02-06 | BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulner… |
CVE-2026-1232 | | 2026-02-02 | A medium-severity vulnerability has been identified in BeyondTrust Privilege Management for Windows versions <=25.7. Under certain conditions, a local authenti… | |
CVE-2025-6250 | Medium | 6.7 | 2025-07-28 | Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the s… |
CVE-2025-2297 | High | 7.8 | 2025-07-28 | Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user… |
CVE-2025-5309 | Critical | 9.8 | 2025-06-16 | The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Server-Side Template Injection vulnerability which can lead t… |
CVE-2025-0217 | High | 7.8 | 2025-05-05 | BeyondTrust Privileged Remote Access (PRA) versions prior to 25.1 are vulnerable to a local authentication bypass. A local authenticated attacker can view the… |
CVE-2025-0889 | High | 7.8 | 2025-02-26 | Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows installed, via the manipulation of COM o… |
CVE-2024-12686 | Medium | 6.6 | 2024-12-18 | A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileg… |
CVE-2024-12356 | Critical | 9.8 | 2024-12-17 | A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to… |
CVE-2024-9110 | Medium | 6.4 | 2024-10-30 | A medium severity vulnerability has been identified within Privileged Identity which can allow an attacker to perform reflected cross-site scripting attacks. |
CVE-2024-5813 | Medium | 5.9 | 2024-06-11 | A medium severity vulnerability in BIPS has been identified where an authenticated attacker with high privileges can access the SSH private keys via an informa… |
CVE-2024-5812 | Low | 3.3 | 2024-06-11 | A low severity vulnerability in BIPS has been identified where an attacker with high privileges or a compromised high privilege account can overwrite Read-Only… |
CVE-2024-4220 | Medium | 4.3 | 2024-06-04 | Prior to 23.1, an information disclosure vulnerability exists within BeyondInsight which can allow an attacker to enumerate usernames. |
CVE-2024-4219 | Medium | 4.8 | 2024-06-04 | Prior to 23.2, it is possible to perform arbitrary Server-Side requests via HTTP-based connectors within BeyondInsight, resulting in a server-side request forg… |
CVE-2024-4018 | High | 8.8 | 2024-04-19 | Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (local appliance api modules) allows Privilege Escalation.This… |
CVE-2024-4017 | High | 8.8 | 2024-04-19 | Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (filesystem modules) allows DLL Side-Loading.This issue affect… |
CVE-2024-25083 | Medium | 6.3 | 2024-02-16 | An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1. When an low-privileged user initiates a repair, there is an attack vector… |
CVE-2024-1591 | Low | 3.3 | 2024-02-16 | Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them… |
CVE-2023-49944 | Medium | 6.7 | 2023-12-25 | The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by d… |
CVE-2020-28369 | High | 7.8 | 2023-12-12 | In BeyondTrust Privilege Management for Windows (aka PMfW) through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location… |
CVE-2020-12614 | High | 7.8 | 2023-12-12 | An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. If the publisher criteria is selected, it defines the name of a publisher… |
CVE-2020-12612 | High | 7.8 | 2023-12-12 | An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. When specifying a program to elevate, it can typically be found within the… |
CVE-2020-12615 | High | 7.8 | 2023-12-12 | An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. When adding the Add Admin token to a process, and specifying that it runs… |
CVE-2021-3187 | High | 8.8 | 2023-12-11 | An issue was discovered in BeyondTrust Privilege Management for Mac before 5.7. An authenticated, unprivileged user can elevate privileges by running a malicio… |
CVE-2020-12613 | High | 8.8 | 2023-12-11 | An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. An attacker can spawn a process with multiple users as part of the securit… |
CVE-2023-23632 | High | 7.8 | 2023-10-12 | BeyondTrust Privileged Remote Access (PRA) versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. Attackers can exploit a flawed secret ver… |
CVE-2023-4310 | Critical | 9.8 | 2023-09-05 | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability which can be exploited… |
CVE-2021-31589 | Medium | 6.1 | 2022-01-05 | A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 and older, which al… |
CVE-2021-42254 | High | 7.8 | 2021-11-19 | BeyondTrust Privilege Management prior to version 21.6 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-3156 | High | 7.8 | 2021-01-26 | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" a… |
CVE-2020-9326 | High | 7.5 | 2020-03-18 | BeyondTrust Privilege Management for Windows and Mac (aka PMWM; formerly Avecto Defendpoint) 5.1 through 5.5 before 5.5 SR1 mishandles command-line arguments w… |
CVE-2018-10959 | High | 7.5 | 2019-04-17 | Avecto Defendpoint 4 prior to 4.4 SR6 and 5 prior to 5.1 SR1 has an Untrusted Search Path vulnerability, exploitable by modifying environment variables to trig… |
CVE-2017-5996 | High | 7.8 | 2017-10-26 | The agent in Bomgar Remote Support 15.2.x before 15.2.3, 16.1.x before 16.1.5, and 16.2.x before 16.2.4 allows DLL hijacking because of weak %SYSTEMDRIVE%\Prog… |