BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA

1. Executive summary

BeyondTrust has released updates for four vulnerabilities — two CRITICAL pre-authentication bypass flaws (CVE-2026-40138, CVSS 9.2; CVE-2026-40139, CVSS 9.2) and two additional high-severity issues (CVE-2026-40140, CVSS 8.7; CVE-2026-40141, CVSS 8.5) — affecting Remote Support (RS) and Privileged Remote Access (PRA). The two critical flaws allow a network-positioned, unauthenticated attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges, when a specific authentication configuration is enabled. None of the four CVEs are currently listed in CISA KEV, and BeyondTrust makes no mention of in-the-wild exploitation; however, prior RS/PRA vulnerabilities (CVE-2024-12356, CVE-2026-1731) have been repeatedly exploited to deploy web shells and backdoors, making rapid patching a priority for EMEA financial services organizations that expose these appliances.

2. Regulatory framing

3. Technical analysis & attack chain

Affected products and versions

• BeyondTrust Remote Support (RS) — versions 25.3.2 and lower; fixed in RS 25.3.3 and above.
• BeyondTrust Privileged Remote Access (PRA) — versions 25.3.2 and lower; fixed in PRA 25.3.3 and above.

Vulnerability details

Verified reference data note: The authoritative verified reference data classifies CVE-2026-40138 as CWE-287 (Improper Authentication), CVSS 9.2 CRITICAL, not in CISA KEV. The source article describes the same flaw as an authentication-subsystem bypass from improper validation of authentication data — both classifications describe the same improper-authentication flaw. No discrepancy exists between the verified CVSS/severity and the source.

Attack chain (confirmed steps)

1. Reconnaissance: The attacker identifies a BeyondTrust RS or PRA appliance exposed to network access (typically HTTPS on TCP 443 for the web interface).
2. Pre-authentication exploitation (CVE-2026-40138 or CVE-2026-40139): A network-positioned, unauthenticated attacker sends crafted authentication data/requests to the appliance's authentication subsystem. Exploitation requires a specific authentication configuration to be enabled on the target appliance.
3. Access control bypass: Improper validation or processing of the authentication data/requests allows the attacker to bypass access controls without valid credentials.
4. Privileged access: The attacker gains unauthorized access to the appliance, including accounts with elevated privileges, providing full administrative control of the remote support/privileged access platform.
5. Post-exploitation (based on historical precedent): Prior exploitation of RS/PRA vulnerabilities (CVE-2024-12356, CVE-2026-1731) involved deployment of web shells and backdoors. While there is no confirmation that these new CVEs have been exploited, the same post-exploitation trajectory is plausible.

Configuration dependency

Exploitation of CVE-2026-40138 and CVE-2026-40139 hinges on a specific authentication configuration being enabled. BeyondTrust has not publicly named which configuration setting is the prerequisite. Clients should audit all authentication-related configurations on their appliances as part of patching.

Additional impact vectors

• CVE-2026-40140: An unauthenticated remote attacker can trigger a denial-of-service condition affecting appliance availability via the network communication subsystem.
• CVE-2026-40141: An authenticated attacker with limited privileges and specific permissions can access unintended resources or data beyond their authorization scope via a web application component.

Attribution and exploitation status

No threat actor attribution is provided in the source material. No MITRE ATT&CK actor profile is available in the verified reference data; attribution is therefore unconfirmed. BeyondTrust makes no mention of any of the four vulnerabilities being exploited in the wild. None of the CVEs are listed in CISA KEV. Historical exploitation of prior RS/PRA CVEs (CVE-2024-12356, CVE-2026-1731) is noted in the source as context for urgency — this is a single-sourced claim from the vendor advisory reporting; verify before enforcement.

Vulnerability discovery context

BeyondTrust identified all vulnerabilities internally as part of ongoing security assessments, with assistance from publicly available AI models (Anthropic Claude Opus 4.8) and proprietary research tooling. This is a single-sourced claim from the vendor; verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

1. Inventory and assess exposure: Identify all BeyondTrust RS and PRA appliances in the estate. Determine which are running version 25.3.2 or lower.
2. Restrict network exposure: Ensure RS and PRA appliance web interfaces are not exposed to the public internet. Limit access to trusted internal management networks via firewall rules, VPN, or IP allowlisting. If an appliance must be internet-facing, place it behind a WAF or reverse proxy capable of deep inspection.
3. Audit authentication configuration: Review all authentication-related configuration settings on each appliance. Since exploitation of CVE-2026-40138 and CVE-2026-40139 requires a specific authentication configuration to be enabled, identify and disable any non-essential or non-standard authentication modes until patches are applied.

P2 — Within 72 hours

4. Patch to fixed versions: - Remote Support (RS): Upgrade to RS 25.3.3 or above. - Privileged Remote Access (PRA): Upgrade to PRA 25.3.3 or above.
5. Verify patch installation: Confirm appliance version post-upgrade via the administrative interface or CLI version check.
6. Containment for suspected compromise: If an appliance is suspected to have been exploited prior to patching: - Isolate the appliance from the network immediately. - Preserve forensic evidence (logs, disk image, memory capture if feasible). - Review web server logs and appliance logs for anomalous authentication events, unexpected session creation, or suspicious file creation (consistent with web shell deployment seen in prior CVE-2024-12356 / CVE-2026-1731 exploitation). - Revoke all credentials, session tokens, and API keys associated with the appliance. - Rebuild the appliance from a known-good image rather than attempting in-place remediation.

P3 — Within 7 days

7. Harden appliance configuration: After patching, review and enforce least-privilege access policies. Disable any authentication configurations that are not required for business operations.
8. Update EDR/monitoring rules: Deploy detection content (see §6) to monitor for exploitation attempts and post-exploitation artefacts.
9. Review third-party risk: If BeyondTrust RS/PRA is managed by a third-party ICT provider, confirm with the provider that patches have been applied and request evidence of remediation.
10. Threat hunt: Conduct a retrospective hunt across appliance logs for indicators of pre-authentication bypass attempts targeting the authentication subsystem, focusing on the period from initial exposure to patch deployment.

5. Indicators of compromise

No indicators of compromise available in the source material.

6. Detection

The source material does not provide specific IOCs, file hashes, command-line strings, registry keys, mutex names, or network indicators associated with exploitation of these vulnerabilities. However, the following detection rules are authored from the technical details and historical exploitation context described in the sources.

YARA rule

The sources reference web shells and backdoors as post-exploption artefacts from prior RS/PRA exploitation (CVE-2024-12356, CVE-2026-1731) but do not provide specific strings, filenames, or file paths for those artefacts. No distinctive strings, file paths, or hardcoded values are present in the source material for the current CVEs. Insufficient indicators to author a YARA rule.

Sigma rule

title: BeyondTrust RS/PRA Authentication Subsystem Bypass Attempt
id: 7a3c1f2e-8b4d-4a6e-9c1f-2d5b8e7a4c3f
status: experimental
description: >
  Detects potential exploitation of CVE-2026-40138 or CVE-2026-40139 targeting
  the BeyondTrust Remote Support / Privileged Remote Access authentication
  subsystem. Monitor for unauthenticated access attempts followed by
  successful session creation or elevated-privilege access.
author: Adverse Trace
date: 2026/07/07
references:

  - https://thehackernews.com/2026/07/beyondtrust-patches-critical-auth.html
  - https://www.bleepingcomputer.com/news/security/beyondtrust-warns-of-critical-flaws-in-remote-access-software/
logsource:
  product: beyondtrust
  service: remote_support
detection:
  selection_auth_bypass:
    event.action|contains:

      - "authentication"
      - "login"
    outcome: "success"
    user.name|contains:

      - "admin"
      - "root"
      - "superadmin"
    filter_preceding_auth_failure:
      event.action|contains:

        - "authentication"
        - "login"
      outcome: "failure"
    timeframe: 5m
    condition: selection_auth_bypass and not filter_preceding_auth_failure
  selection_unexpected_admin_session:
    event.action: "session_created"
    user.privileges: "elevated"
    source.ip|cidr:

      - "0.0.0.0/0"
  condition: selection_auth_bypass or selection_unexpected_admin_session
falsepositives:

  - Legitimate administrative login from a new or unusual source IP
  - Automated monitoring or health-check systems performing authentication
level: high

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• The Hacker News — "BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA" — https://thehackernews.com/2026/07/beyondtrust-patches-critical-auth.html — 2026-07-07
• BleepingComputer — "BeyondTrust warns of critical flaws in remote access software" — https://www.bleepingcomputer.com/news/security/beyondtrust-warns-of-critical-flaws-in-remote-access-software/ — 2026-07-07
• GitHub Security Advisories — "BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem" — https://github.com/advisories/GHSA-8v46-5p7g-p46j
• GitHub Security Advisories — "A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support" — https://github.com/advisories/GHSA-v5xx-3hcf-fm67

8. Adverse Trace position

Severity: CRITICAL. CVE-2026-40138 and CVE-2026-40139 (both CVSS 9.2) are pre-authentication bypass vulnerabilities in BeyondTrust RS/PRA that grant unauthenticated, network-positioned attackers access to elevated-privilege accounts under a specific authentication configuration. Neither CVE is in CISA KEV and there is no confirmed in-the-wild exploitation; however, the historical exploitation pattern of prior RS/PRA vulnerabilities (CVE-2024-12356, CVE-2026-1731) for web shell and backdoor deployment elevates the risk of delayed patching. EMEA financial services clients running RS 25.3.2 or lower or PRA 25.3.2 or lower should treat patching to RS/PRA 25.3.3+ as a P1 action and immediately restrict appliance network exposure. Adverse Trace will monitor for emerging exploitation reporting, IOCs, or threat actor attribution and will issue an update if CISA KEV inclusion or confirmed in-the-wild exploitation is observed. Attribution is unconfirmed — no MITRE ATT&CK actor profile is available in the verified reference data.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.