Summary
CVE-2026-40139 is a critical pre-authentication vulnerability (CVSS 4.0: 9.2) in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. The flaw stems from improper processing of authentication requests, allowing an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance — including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled on the target instance.
Technical details
- Root cause: Improper Authentication (CWE-287) — the authentication subsystem fails to correctly validate or enforce authentication checks under certain configuration conditions, allowing crafted requests to bypass access controls entirely.
- Trigger conditions: Exploitation requires a specific authentication configuration to be enabled on the BeyondTrust appliance (reflected as Attack Requirements: Present — AT:P — in the CVSS 4.0 vector). Instances without that configuration enabled are not affected, but organizations cannot assume their deployments are not configured this way without verification.
- Attack vector: Network-accessible; no authentication, no user interaction, and no special privileges are required. The vulnerability is exploitable remotely against any internet-exposed instance meeting the configuration prerequisite.
- Impact: Successful exploitation results in unauthorized access to the appliance, including accounts with elevated privileges — corresponding to full compromise of confidentiality, integrity, and availability (VC:H / VI:H / VA:H).
Affected software
- BeyondTrust Remote Support: all versions prior to 25.3.3 and prior to 26.2.1
- BeyondTrust Privileged Remote Access: all versions prior to 25.3.3 and prior to 26.2.1
Severity
- CVSS 4.0 Base Score: 9.2 (Critical)
- Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate — Apply vendor patch: Upgrade to BeyondTrust Remote Support version 25.3.3 or 26.2.1 (or later) and Privileged Remote Access version 25.3.3 or 26.2.1 (or later), per BeyondTrust security advisory BT26-03.
- If immediate patching is not feasible: Review and disable the specific authentication configuration identified as the prerequisite for exploitation. Consult the BeyondTrust advisory (BT26-03) for configuration guidance, and restrict network access to the appliance management interface to trusted IP ranges only.
- Verification: Organizations running BeyondTrust Remote Support or Privileged Remote Access should audit their deployed version and authentication configuration without delay.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.