Critical Authentication Bypass Vulnerabilities in BeyondTrust Remote Support and PRA
Executive Summary
In July 2026, BeyondTrust disclosed two critical pre-authentication vulnerabilities (CVE-2026-40138 and CVE-2026-40139) in their Remote Support (RS) and Privileged Remote Access (PRA) products. These flaws stemmed from improper validation and processing of authentication data, potentially allowing unauthenticated attackers to bypass access controls and gain elevated privileges. Exploitation required specific authentication configurations to be enabled. BeyondTrust promptly released patches to address these issues.
The disclosure underscores the persistent risk of authentication bypass vulnerabilities in remote access solutions. Organizations are urged to review and update their security configurations regularly to mitigate such threats.
Why This Matters Now
The recent disclosure of critical authentication bypass vulnerabilities in BeyondTrust's Remote Support and Privileged Remote Access products highlights the ongoing risks associated with remote access solutions. Organizations must promptly apply patches and review their security configurations to prevent unauthorized access and potential data breaches.
Attack Path Analysis
An unauthenticated attacker exploits a pre-authentication vulnerability in BeyondTrust Remote Support to gain unauthorized access. The attacker escalates privileges to access high-level accounts. They move laterally within the network to identify and access sensitive systems. Establishing command and control channels, the attacker maintains persistent access. Sensitive data is exfiltrated from compromised systems. The attack culminates in significant data loss and potential operational disruption.
Kill Chain Progression
Initial Compromise
Description
An unauthenticated attacker exploits a pre-authentication vulnerability in BeyondTrust Remote Support to gain unauthorized access.
Related CVEs
CVE-2026-40138
CVSS 8.1A pre-authentication vulnerability in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access allows unauthenticated attackers to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges.
Affected Products:
BeyondTrust Remote Support – <= 25.3.2
BeyondTrust Privileged Remote Access – <= 25.3.2
Exploit Status:
no public exploitCVE-2026-40139
CVSS 9.2A pre-authentication vulnerability in the authentication subsystem of BeyondTrust Remote Support allows unauthenticated remote attackers to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges.
Affected Products:
BeyondTrust Remote Support – <= 25.3.2
Exploit Status:
no public exploitCVE-2026-40140
CVSS 8.7A pre-authentication vulnerability in the network communication subsystem of BeyondTrust Remote Support and Privileged Remote Access allows unauthenticated remote attackers to trigger a denial-of-service condition, affecting appliance availability.
Affected Products:
BeyondTrust Remote Support – <= 25.3.2
BeyondTrust Privileged Remote Access – <= 25.3.2
Exploit Status:
no public exploitCVE-2026-40141
CVSS 8.5A vulnerability in a web application component of BeyondTrust Remote Support and Privileged Remote Access allows authenticated attackers with limited privileges to access unintended resources or data beyond their authorization scope.
Affected Products:
BeyondTrust Remote Support – <= 25.3.2
BeyondTrust Privileged Remote Access – <= 25.3.2
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Valid Accounts
External Remote Services
Modify Authentication Process
Application Layer Protocol
Default Accounts
AS-REP Roasting
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Strong Authentication for Users
Control ID: 8.2.1
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: 500.12
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – Identity
Control ID: Pillar 1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Critical authentication bypass vulnerabilities in BeyondTrust remote access solutions directly expose IT infrastructure management systems to unauthenticated takeover attacks.
Financial Services
Pre-authentication flaws in privileged remote access tools threaten financial institutions' secure remote operations and regulatory compliance under strict data protection requirements.
Health Care / Life Sciences
Remote support system vulnerabilities compromise healthcare organizations' privileged access controls, potentially exposing patient data and violating HIPAA compliance frameworks.
Government Administration
Authentication bypass vulnerabilities in remote access platforms create critical security gaps for government agencies managing sensitive systems and classified information remotely.
Sources
- BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRAhttps://thehackernews.com/2026/07/beyondtrust-patches-critical-auth.htmlVerified
- BeyondTrust warns of critical flaws in remote access softwarehttps://www.bleepingcomputer.com/news/security/beyondtrust-warns-of-critical-flaws-in-remote-access-software/Verified
- BeyondTrust Security Advisory BT26-03https://www.beyondtrust.com/trust-center/security-advisories/bt26-03Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it likely limits unauthorized lateral movement and data exfiltration by enforcing strict workload segmentation and identity-aware policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While initial access may still occur, Aviatrix CNSF would likely limit the attacker's ability to move laterally or escalate privileges within the network.
Control: Zero Trust Segmentation
Mitigation: Aviatrix Zero Trust Segmentation would likely limit the attacker's ability to access high-level accounts by enforcing strict identity-based access controls.
Control: East-West Traffic Security
Mitigation: Aviatrix East-West Traffic Security would likely limit the attacker's ability to move laterally by enforcing strict workload-to-workload communication policies.
Control: Multicloud Visibility & Control
Mitigation: Aviatrix Multicloud Visibility & Control would likely limit the attacker's ability to establish and maintain command and control channels by providing comprehensive monitoring and control over network traffic.
Control: Egress Security & Policy Enforcement
Mitigation: Aviatrix Egress Security & Policy Enforcement would likely limit the attacker's ability to exfiltrate sensitive data by enforcing strict outbound traffic policies.
Aviatrix Zero Trust CNSF would likely limit the overall impact of the attack by containing the attacker's activities and reducing the blast radius.
Impact at a Glance
Affected Business Functions
- Remote Support Services
- Privileged Access Management
Estimated downtime: N/A
Estimated loss: N/A
Potential unauthorized access to sensitive systems and data.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict access and limit lateral movement.
- • Deploy East-West Traffic Security to monitor and control internal network communications.
- • Utilize Multicloud Visibility & Control to detect and respond to anomalous activities across cloud environments.
- • Enforce Egress Security & Policy Enforcement to prevent unauthorized data exfiltration.
- • Apply Inline IPS (Suricata) to detect and block known exploit patterns and malicious payloads.
