What are CVE-2026-40138 and CVE-2026-40139? BeyondTrust has released critical security updates addressing severe pre-authentication bypass vulnerabilities in its Remote Support (RS) and Privileged Remote Access (PRA) solutions. Tracked as CVE-2026-40138 and CVE-2026-40139, these flaws allow unauthenticated, network-positioned attackers to bypass access controls entirely, granting unauthorized access to the administration console and enabling complete takeover of highly privileged technician sessions.

Executive Summary

BeyondTrust, a global leader in privileged access management (PAM), has released critical security updates addressing two severe pre-authentication vulnerabilities in its flagship Remote Support (RS) and Privileged Remote Access (PRA) solutions. Tracked as CVE-2026-40138 and CVE-2026-40139 (each carrying a CVSS score of 9.2), the flaws reside within the appliances' authentication processing subsystems.

Exploitation allows unauthenticated, network-positioned attackers to bypass access controls entirely, granting unauthorized access to the administration console and enabling complete takeover of highly privileged technician sessions. Because remote access gateways are high-value targets, organizations utilizing unpatched versions are urged to deploy the updates immediately. Delaying these critical updates may result in severe organizational data breaches, ransomware deployment, or widespread internal network pivoting by malicious actors.

Technical Deep-Dive into the Vulnerabilities

BeyondTrust Remote Support and Privileged Remote Access are enterprise-class appliances deployed to facilitate secure, just-in-time remote desktop, technician assistance, and administrative access to high-trust network zones. Because these gateways typically sit on the network perimeter and bridge trusted and untrusted zones, they are critical security boundaries.

The vulnerabilities represent critical logical validation flaws categorized under CWE-287: Improper Authentication and CWE-302: Authentication Bypass by Assumed Relation. In complex federated identity environments, proper validation of all inbound authentication tokens and assertions is essential to prevent unauthorized access.

Exploit Mechanics and Vulnerability Flows

Understanding the exact mechanics of these flaws is crucial for defenders to implement proper monitoring and forensic analysis:

• 1. The Authentication Subsystem: The flaws sit directly within BeyondTrust's authentication validation pipelines, which process inbound login requests and assertion payloads. This subsystem is responsible for verifying cryptographic signatures and identity claims.
• 2. Improper Validation (CVE-2026-40138): Under certain configurations, the authentication subsystem fails to properly validate incoming assertion data. An attacker positioned on the network can forge authentication payloads, tricking the appliance into assuming a pre-authenticated relation. This allows the attacker to impersonate legitimate administrators.
• 3. Request Processing Flaw (CVE-2026-40139): This vulnerability involves improper parsing of multi-stage authentication requests. Attackers can leverage specific parameter configurations to bypass access checks and gain administrative rights without presenting valid credentials, completely neutralizing multifactor authentication (MFA) defenses.
• 4. High Availability Risk (CVE-2026-40140): In addition to the bypass flaws, BeyondTrust patched a high-severity pre-authentication vulnerability (CVSS 8.7) in the network communication subsystem. Insufficient validation of client-supplied inputs allows unauthenticated remote attackers to trigger memory exhaustion and denial-of-service (DoS) conditions, potentially crashing the gateway.

Vulnerability Summary Table

Affected Versions: Remote Support (RS) prior to 26.2.1 and Privileged Remote Access (PRA) prior to 25.3.3.

Industry Impact and Threat Landscape

Privileged access gateways are one of the most critical perimeter defense lines for modern enterprises. These appliances hold administrative keys to active databases, active directory domains, and production servers. When compromised, they offer attackers uninhibited access to the entire corporate infrastructure.

A pre-authentication bypass on a remote gateway is a "keys to the kingdom" scenario. An attacker who successfully exploits CVE-2026-40138 can reach the BeyondTrust admin panel, create rogue technician profiles, hijack active administrative sessions, and laterally pivot into the enterprise internal network. Because the vulnerability requires zero prior credentials, automated botnets and ransomware syndicates are actively searching the public internet for exposed, unpatched BeyondTrust ports. The immediate exploitation of such vulnerabilities is a known tactic among advanced persistent threat (APT) groups.

Recommendations and Mitigations

Organizations utilizing BeyondTrust remote assistance appliances must execute immediate emergency remediation protocols to secure their environments:

• Deploy Emergency Patches: Immediately upgrade Remote Support (RS) deployments to version 26.2.1 or later, and Privileged Remote Access (PRA) gateways to version 25.3.3 or later. Prioritize public-facing instances.
• Review Configuration Settings: Note that both bypass flaws require specific authentication configurations to be enabled. Review BeyondTrust trust logs and ensure only highly secure SAML/OIDC federations are active. Disable legacy authentication protocols if they are not strictly required.
• Restrict Network Exposure: Place BeyondTrust administration portals behind a virtual private network (VPN) or secure firewall, restricting public internet exposure to only essential client-facing endpoints. Utilize IP allowlisting where feasible.
• Audit Session Logs: Conduct a comprehensive forensic sweep of BeyondTrust event logs, specifically inspecting session creation records, newly generated technician profiles, and unauthenticated access requests matching the patched builds. Look for anomalous login times or unrecognized IP addresses originating from foreign geographic locations.

Frequently Asked Questions