BeyondTrust has disclosed four vulnerabilities affecting its Remote Support (RS) and Privileged Remote Access (PRA) products in advisory BT26-03, including two critical authentication-bypass flaws with a maximum CVSS v4 score of 9.2.
The issues were identified internally through BeyondTrust’s AI-driven vulnerability research program, which used publicly available AI models and was conducted independently of Project Glasswing.
The most severe issues, CVE-2026-40138 and CVE-2026-40139, both scoring 9.2 on CVSS v4, stem from improper authentication (CWE-287) in the authentication subsystem shared across RS and PRA appliances.
BeyondTrust Patches Critical Flaws
CVE-2026-40138 allows a network-positioned attacker to bypass access controls under specific authentication configurations, potentially gaining elevated privileges, though its exploitation requires somewhat higher attack complexity than that of its counterpart.
CVE-2026-40139 is more directly exploitable, enabling an unauthenticated remote attacker to bypass authentication entirely through improperly processed authentication requests, provided a specific configuration is enabled on the target appliance.
BeyondTrust stated that both flaws could grant attackers unauthorized administrative access to affected systems, making them attractive targets in environments where the vulnerable configurations remain active.
Two additional high-severity vulnerabilities round out the advisory. CVE-2026-40140, scoring 8.7, is an uncontrolled resource consumption flaw (CWE-400) in the network communication subsystem that lets unauthenticated attackers trigger denial-of-service conditions, disrupting appliance availability without requiring any user interaction.
CVE-2026-40141, scoring 8.5, is an improper input neutralization issue (CWE-943) in a web application component that allows an authenticated attacker with limited privileges to access data or resources beyond their authorization scope, though exploitation is restricted to accounts holding specific permissions.
Patch and Mitigation
BeyondTrust has already remediated cloud-hosted RS/PRA instances and applied patches as of April 21, 2026. Self-hosted customers face two remediation paths depending on their update configuration.
- Customers not on automatic updates should apply the April 2026 security rollup for their current version.
- Alternatively, upgrading to RS 25.3.3 or PRA 25.3.3 (or later) resolves all four vulnerabilities.
All versions of RS and PRA at or below 25.3.2 are considered vulnerable. Given the critical nature of the authentication-bypass flaws and their potential to compromise the appliance.
Security teams managing self-hosted BeyondTrust deployments should prioritize patching immediately, particularly if remote-access configurations align with those flagged as exploitable in the advisory.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 and Privileged Remote Access (PRA) products in advisory BT26-03, including two critical authentication-bypass flaws with a maximum CVSS v4 score of 9.2.){kind=link}