CVE-2026-40139 is a critical authentication bypass in BeyondTrust Remote Support and Privileged Remote Access, scored CVSS 9.8. An unauthenticated remote attacker may reach the appliance, including privileged accounts, when a specific authentication configuration is enabled. BeyondTrust advisory BT26-03 lists the fix.
What's affected
The NVD record names two products, BeyondTrust Remote Support and Privileged Remote Access, and says exploitation needs a specific authentication configuration to be enabled. It does not list version numbers.
The vendor advisory is BT26-03. The BeyondTrust site blocked my automated fetch, so I could not read affected and fixed build numbers and will not state them. Open the advisory yourself for the exact builds and any patch or hotfix steps.
How to check if you're exposed
- Open the BeyondTrust advisory BT26-03 and note the affected builds and the authentication configuration it names.
- Sign in to your appliance admin interface and read the current version.
- Check whether the named authentication setting is enabled on your appliance.
- If you are on an affected build, treat the appliance as exposed until patched. Review its access logs for sign ins you do not recognise, particularly to privileged accounts.
What to do now
- Read BT26-03 and identify your appliances, including cloud and test ones.
- Apply the patch or fixed build the advisory names.
- Restrict network access to the appliance to the addresses that need it while you patch.
- Review recent privileged sessions and account changes.
- If the advisory suggests a configuration change as a mitigation, apply it until the patch lands.
Why it matters
The weakness is CWE-287, improper authentication. Remote access appliances are built to be reachable and to hold powerful credentials, so a bypass before login is the worst place for this class of flaw. The same advisory covers CVE-2026-40141, a separate high severity issue in the same products.
The record does not mark this CVE as exploited in the wild, and I found no vendor text saying so. Check the CISA KEV catalog for any change after this review.
Quick check
Is every BeyondTrust appliance affected?
The record says exploitation requires a specific authentication configuration. Use the advisory to confirm whether yours matches.
Sources
- BeyondTrust advisory BT26-03 (referenced by the NVD record; not readable by my fetch)
- Gold page for this CVE
Last reviewed: 19 October 2026.
