Beyondtrust Privileged Remote Access — CVE-2026-40139 (Critical)

Date Jul 6, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Beyondtrust · Privileged Remote Access

CVE CVE-2026-40139

Critical vendor advisory CVE-2026-40139

Summary

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Beyondtrust Privileged Remote Access. Patch or mitigate promptly. EPSS percentile: 49%.

Operator check

Review CVE-2026-40139 in your asset inventory. Apply patches per vendor guidance and verify Privileged Remote Access is not exposed. CVSS score: 9.8. EPSS probability: 0.7%; percentile: 49%.

Sources

NVD — CVE-2026-40139 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed