BT26-03

• Issue Date: 06-21-2026
• Updated On: 06-21-2026
• Max CVSS v4 Score: 9.2
• Impacted Product(s): Remote Support (RS) & Privilege Remote Access (PRA)

This security advisory addresses multiple internally discovered vulnerabilities affecting Remote Support and Privileged Remote Access products. These issues were identified by the BeyondTrust Product Security team as part of ongoing security assessments. Customers are advised to review the details below and update to the fixed versions as outlined.

BeyondTrust Remote Support and Privileged Remote Access are affected by multiple internally discovered vulnerabilities ranging from critical to high severity. These vulnerabilities were identified through BeyondTrust's internal security research program. These vulnerabilities were identified through BeyondTrust's own AI-driven vulnerability research using publicly available AI models (Opus 4.8) and our proprietary research tooling. The work was conducted independently of Project Glasswing.

The most severe vulnerabilities may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance under specific configurations. Additional vulnerabilities may allow service disruption, unintended data access, and under distinct configurations, elevated access by an authenticated user that may impact system integrity.

• Severity: Critical
• CVSS v4 Score: 9.2
• CVSS v4 Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
• CWE: CWE-287 Improper Authentication

Description

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access.

Impact

Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

• Severity: Critical
• CVSS v4 Score: 9.2
• CVSS v4 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
• CWE: CWE-287 Improper Authentication

Description

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support.

Impact

Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

• Severity: High
• CVSS v4 Score: 8.7
• CVSS v4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
• CWE: CWE-400 Uncontrolled Resource Consumption
  

Description

BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem.

Impact

Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.

• Severity: High
• CVSS v4 Score: 8.5
• CVSS v4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
• CWE: CWE-943 Improper Neutralization of Special Elements in Data Query Logic
  

Description

A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters.

Impact

Insufficient validation of user-supplied input may allow an authenticated attacker with limited privileges to access unintended resources or data beyond their authorization scope. Exploitation is restricted to accounts with specific permissions.

A patch has been applied to all RS/PRA cloud customers as of April 21,2026.

Self-hosted customer should apply the April security rollup patch for the affected version if their instance is not subscribed to automatic updates or upgrade to RS 25.3.3 & above or PRA 25.3.3 & above.

• https://www.cve.org/CVERecord?id=CVE-2026-40138
• https://www.cve.org/CVERecord?id=CVE-2026-40139
• https://www.cve.org/CVERecord?id=CVE-2026-40140
• https://www.cve.org/CVERecord?id=CVE-2026-40141
• https://nvd.nist.gov/vuln/detail/CVE-2026-40138
• https://nvd.nist.gov/vuln/detail/CVE-2026-40139
• https://nvd.nist.gov/vuln/detail/CVE-2026-40140
• https://nvd.nist.gov/vuln/detail/CVE-2026-40141
• https://beyondtrustcorp.service-now.com/csm?id=kb_article&sysparm_article=KB0023700