This vulnerability (CVE-2026-40138) in BeyondTrust Remote Support and Privileged Remote Access stems from improper validation of authentication data in the authentication subsystem. It enables an attacker positioned on the network to bypass access controls and access the appliance without proper authorization, potentially gaining elevated privileges. Exploitation depends on a particular authentication configuration being enabled. As of the published date, no vendor advisory or patch is available, and the product is not a cloud service, so remediation is not managed server-side by the vendor.

Successful exploitation can lead to unauthorized access to the BeyondTrust appliance, including accounts with elevated privileges, potentially compromising the confidentiality, integrity, and availability of the system. This could allow attackers to perform administrative actions on the appliance. The vulnerability is critical with a CVSS 4.0 score of 9.2, reflecting network attack vector, high complexity, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, organizations should review their authentication configurations in BeyondTrust Remote Support and Privileged Remote Access to identify if the specific vulnerable configuration is enabled and consider disabling or restricting it until a patch is available.