CVE-2026-40141 is a high severity flaw in the web application of BeyondTrust Remote Support and Privileged Remote Access, scored CVSS 9.9. Insufficient input validation can let a limited privilege user reach data beyond their authorization. BeyondTrust advisory BT26-03 holds the fixed build details.
What's affected
The NVD record names BeyondTrust Remote Support and Privileged Remote Access. It says exploitation is limited to accounts with specific permissions. No versions are listed.
The advisory is BT26-03. Its page blocked my automated fetch, so I cannot report affected or fixed builds. Read the advisory for them. This CVE shares that advisory with CVE-2026-40139, which is a separate pre-login authentication issue.
How to check if you're exposed
- Open BT26-03 and note the affected builds.
- Read your appliance version from its administration interface.
- List which accounts hold the permission the advisory describes, since exploitation needs an authenticated account with specific rights.
- Compare your build with the fixed build, and treat anything older as exposed.
What to do now
- Read BT26-03 and patch to the fixed build.
- Audit accounts on the appliance and remove permissions and accounts that are not needed.
- Review activity from low privilege accounts for access outside their normal scope.
- Restrict who can reach the appliance interface at the network level.
Why it matters
The weakness is CWE-943, improper neutralization of special elements in a data query. In plain terms, input is trusted when it builds a data lookup, so a user can get results the application meant to withhold. The CVSS vector scores scope as changed, which means the impact can reach beyond the component itself.
The score of 9.9 needs a logged in account, so the first control is keeping accounts few and reviewed. The record does not report exploitation in the wild.
Quick check
Do I need to patch if I trust all my users?
Yes. Accounts get phished and reused, and the fix removes the weakness regardless.
Sources
- BeyondTrust advisory BT26-03 (referenced by the NVD record; not readable by my fetch)
- Gold page for this CVE
Last reviewed: 19 October 2026.
