This vulnerability (CVE-2026-40138) affects the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Due to improper validation of authentication data, a network attacker can bypass access controls before authentication is completed, potentially gaining unauthorized access to the appliance with elevated privileges. Exploitation depends on a particular authentication configuration being enabled. The CVSS 4.0 base score is 9.2, indicating critical severity. No vendor advisory or patch information is currently available, and the affected versions are not explicitly stated.

Successful exploitation allows an unauthenticated attacker with network access to bypass authentication controls and gain unauthorized access to the BeyondTrust appliance, including accounts with elevated privileges. This could lead to full compromise of the affected system and unauthorized administrative control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and disable the specific authentication configuration required for exploitation if possible, and limit network exposure of the affected appliance to trusted networks only.