{"id":2669,"date":"2026-07-08T04:47:23","date_gmt":"2026-07-08T11:47:23","guid":{"rendered":"https:\/\/www.cycognito.com\/blog\/?p=2669"},"modified":"2026-07-08T04:48:03","modified_gmt":"2026-07-08T11:48:03","slug":"emerging-threat-cve-2026-40138-cve-2026-40139-beyondtrust-remote-support-authentication-bypass","status":"publish","type":"post","link":"https:\/\/www.cycognito.com\/blog\/emerging-threat-cve-2026-40138-cve-2026-40139-beyondtrust-remote-support-authentication-bypass\/","title":{"rendered":"Emerging Threat: (CVE-2026-40138 & CVE-2026-40139) BeyondTrust Remote Support Authentication Bypass"},"content":{"rendered":"\n

What are CVE-2026-40138 and CVE-2026-40139?<\/h2>\n\n\n\n

CVE-2026-40138 and CVE-2026-40139 are two pre-authentication vulnerabilities in the authentication subsystem of BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA), stemming from improper validation and processing of authentication data. Both carry a CVSS v3.1 base score of 9.2 (Critical).<\/p>\n\n\n\n

CVE-2026-40138 affects both RS and PRA and allows a network-positioned attacker to bypass access controls through improperly validated authentication data, though exploitation depends on a specific authentication configuration being enabled and carries somewhat higher attack complexity. CVE-2026-40139 affects RS specifically and is more directly exploitable: an unauthenticated remote attacker can bypass authentication entirely by exploiting how the appliance processes authentication requests, again contingent on a specific configuration being active.<\/p>\n\n\n\n

Both flaws are exploitable pre-authentication and can grant an attacker unauthorized access to the appliance, including accounts with elevated privileges. BeyondTrust has not disclosed which exact configurations are affected, only that exploitation is limited to appliances with those settings enabled.<\/p>\n\n\n\n

What assets are affected by CVE-2026-40138 and CVE-2026-40139?<\/h2>\n\n\n\n

The vulnerable component is the login and authentication interface exposed by BeyondTrust RS and PRA appliances, versions 25.3.2 and earlier. In practice, an affected asset is a web-facing login panel, such as a Remote Support or Privileged Remote Access portal, running on either a self-hosted appliance or a cloud-hosted instance.<\/p>\n\n\n\n

These appliances are deployed specifically to grant remote, often privileged, access into internal systems for support and administration purposes, which makes their login interfaces a high-value target by design. They are frequently exposed to the internet because remote vendors, contractors, or distributed IT teams need to reach them from outside the corporate network, and that same reachability is what puts them in scope for external attack surface monitoring.<\/p>\n\n\n\n

BeyondTrust products have a track record of being targeted once flaws are disclosed, including prior incidents involving state-sponsored actors and ransomware operators. That history raises the urgency of identifying and remediating exposed instances quickly.<\/p>\n\n\n\n

What does our data show about exposure patterns?<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Exposure in this set is led by Consumer Discretionary at 16.8% of observed assets, with Health Care contributing 14.4% and Industrials a further 12.6%.<\/p>\n\n\n\n

Consumer Discretionary and Health Care organizations tend to run large networks of franchised, acquired, or partner-operated locations, each with its own vendor support relationships and remote-access requirements. That structure multiplies the number of externally exposed support portals, and it also means responsibility for patching often sits with a third party rather than the parent organization’s own security team.<\/p>\n\n\n\n

The broad spread across the remaining sectors, reflected in the 56.3% share held by Others, points to a pattern that is more about how remote-access tooling is deployed than about any single industry’s risk profile. Wherever an organization outsources IT support, field service, or vendor access, an internet-facing RS or PRA instance is likely to be part of that arrangement, and it is easy for these appliances to fall outside the asset inventories that guide routine patch management.<\/p>\n\n\n\n

Are fixes available?<\/h2>\n\n\n\n

Patches are available. BeyondTrust applied the fix to all Remote Support and Privileged Remote Access cloud (SaaS) instances automatically as of April 21, 2026. Self-hosted customers who are not subscribed to automatic updates need to apply the April 2026 security rollup for their current version, or upgrade directly to RS 25.3.3 or PRA 25.3.3 or later, either of which resolves both CVE-2026-40138 and CVE-2026-40139 along with two related high-severity issues disclosed in the same advisory (CVE-2026-40140 and CVE-2026-40141).<\/p>\n\n\n\n

All RS and PRA versions at or below 25.3.2 are considered vulnerable. Defenders should confirm their specific version and patch status directly against BeyondTrust’s advisory rather than assuming automatic updates were applied, particularly for self-hosted deployments.<\/p>\n\n\n\n

Are there any other recommended actions to take?<\/h2>\n\n\n\n

Until self-hosted instances are confirmed patched, defenders should:<\/p>\n\n\n\n