CVE-2026-40140
published 2026-07-06CVE-2026-40140: BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem…
PriorityP350high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.65%
50.0th percentile
BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| beyondtrust | privileged_remote_access | < 25.3.3 | 25.3.3 |
| beyondtrust | privileged_remote_access | <= 25.3.2 | — |
| beyondtrust | remote_support | < 25.3.3 | 25.3.3 |
| beyondtrust | remote_support | <= 25.3.2 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
BeyondTrust Remote Support and Privileged Remote Access up to 25.3.2/26.2.0 denial of service
vuldb·2026-07-06·CVSS 8.7
CVE-2026-40140 [HIGH] BeyondTrust Remote Support and Privileged Remote Access up to 25.3.2/26.2.0 denial of service
A vulnerability labeled as problematic has been found in BeyondTrust Remote Support and Privileged Remote Access up to 25.3.2/26.2.0. This impacts an unknown function. Such manipulation leads to denial of service.
This vulnerability is traded as CVE-2026-40140. The attack may be launched remotely. There is no exploit available.
GHSA
BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem.
ghsa_unreviewed·2026-07-06
CVE-2026-40140 [HIGH] CWE-400 BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem.
BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
blogs_hackernews·2026-07-13
CVE-2026-50746 ⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
Somewhere right now, a security tool is quietly finding bugs faster than any human can fix them. That's supposed to be the good news. The catch is that the attackers have the same tools, pointed the other way, and they don't file tickets.
That's the shape of this week. Trusted code turns on the people who installed it. Old bugs from last year are still landing because the fix sat in a queue too long. Fake installers, poisoned packages, systems left facing the open internet, and helpful little AI assistants running instructions that were
Hackernews
BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA
blogs_hackernews·2026-07-07·CVSS 8.1
CVE-2026-40138 [HIGH] BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA
BeyondTrust has released updates to address two critical security flaws affecting Remote Support (RS) and Privileged Remote Access (PRA) products that, if successfully exploited, could allow unauthenticated attackers to take control of susceptible devices.
The vulnerabilities are listed below -
CVE-2026-40138 (CVSS score: 9.2) - A pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access stemming from improper validation of authentication data that could allow a network-positioned
2026-07-06
Published