BeyondTrust has addressed two critical security vulnerabilities in its Remote Support (RS) and Privileged Remote Access (PRA) products. These flaws, if left unpatched, could allow unauthorized attackers to seize control of affected devices.
Details of Discovered Vulnerabilities
Each identified flaw could potentially lead to serious security breaches. The vulnerabilities, assigned CVE-2026-40138 and CVE-2026-40139, both received a high CVSS score of 9.2. They result from improper validation and processing of authentication data, enabling attackers to bypass security controls and access privileged accounts without authorization.
Additionally, CVE-2026-40140, with a CVSS score of 8.7, arises from inadequate validation of client inputs, which could trigger a denial-of-service state. Another vulnerability, CVE-2026-40141, with a score of 8.5, involves insufficient input validation that might allow authenticated users to access unauthorized resources.
Conditions for Exploitation
Exploitation of CVE-2026-40138 and CVE-2026-40139 is contingent on specific authentication settings being active. The vulnerability CVE-2026-40141, on the other hand, requires specific user permissions for exploitation.
BeyondTrust discovered these issues internally through rigorous security assessments, utilizing advanced AI tools such as Anthropic Claude Opus 4.8, alongside proprietary research methods. The company emphasizes that unpatched systems may face unauthorized access and potential service disruptions.
Recommended Actions and Updates
To mitigate these risks, BeyondTrust has released patches in RS version 25.3.3 and PRA version 25.3.3. Users operating on versions 25.3.2 or lower are advised to update immediately to protect their systems from potential exploitation.
While there have been no reports of these vulnerabilities being exploited in the wild, similar security issues in the past have led to the deployment of web shells and backdoors. Therefore, timely application of updates is crucial for maintaining system integrity and security.
By addressing these vulnerabilities promptly, BeyondTrust underscores its commitment to maintaining high security standards and protecting its users from potential cyber threats.
