Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

BeyondTrust Releases Security Advisory for Remote Support & Privileged Remote Access

Advisory addresses 2 critical impact and 2 high impact vulnerabilities

Threat ID:
CC-4809
Threat Severity:
Medium
Published:
7 July 2026 3:32 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Advisory addresses 2 critical impact and 2 high impact vulnerabilities

Threat details

Introduction

BeyondTrust has released a security advisory to address 4 vulnerabilities in the Remote Support and Privileged Remote Access systems. Remote Support allows authorised individuals such as IT Helpdesk staff to connect to remote systems. Privileged Remote Access facilitates just-in-time secure access to enterprise environments.

Vulnerability details

  • CVE-2026-40138 – Improper Authentication (CWE-287) – CVSS v4 score: 9.2 (critical)
  • CVE-2026-40139 – Improper Authentication (CWE-287) – CVSSv4 score: 9.2 (critical) 
  • CVE-2026-40140 – Uncontrolled Resource Consumption that could lead to a denial-of-service condition – CVSSv4 score: 8.7 (high) 
  • CVE-2026-40141 – Improper Neutralisation of Special Elements in Data Query Logic – CVSSv4 score: 8.5 (high) 

Remediation advice

Affected organisations are encouraged to review the BeyondTrust Security Advisory BT26-03, and apply the relevant updates.

CVE Vulnerabilities

Status Published

CVE-2026-40138

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled
Status Published

CVE-2026-40139

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.
Status Published

CVE-2026-40140

BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.
Status Published

CVE-2026-40141

A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated attacker with limited privileges to access unintended resources or data beyond their authorization scope. Exploitation is restricted to accounts with specific permissions.

Last edited: 7 July 2026 3:33 pm