Vulnerability Report

CVE-2026-40139

Title: Critical pre-authentication bypass in BeyondTrust Remote Support

Auth Bypass

Proof Of Concept

No public PoC currently indexed for CVE-2026-40139.

CWE Category CWE-287

Published Date Jul 06, 2026

Modified Date Jul 07, 2026

Exploit Status Not Found

Score 9.2 CVSS v4.0

Exploit Probability (EPSS)

0.75%

Vulnerability Summary

CVE-2026-40139: A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

Impacted Vendors

beyondtrust 2

Reference Links

https://www.beyondtrust.com/trust-center/security-advisories/bt26-03

CVSS v4.0

Source Entity 13061848-ea10-403d-bd75-c83a022c2891

Severity CRITICAL

9.2

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]