CVE-2026-40138: fallo crítico en BeyondTrust Remote Support
Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ella tiene alerta oficial del gobierno de Brasil.
ssvc Trackcvss 9.2epss 0.5%
Alerta oficial en Brasil
El gobierno federal de Brasil publicó una alerta, recomendación o boletín que cita esta vulnerabilidad.
- CISC Gov.br · 14 jul 2026Boletim do CISC de Vulnerabilidadeleer en gov.br ↗
Fuente: CTIR Gov (GSI) y CISC Gov.br, bajo licencia CC BY-ND 3.0.
A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVEs relacionadas — BeyondTrust Remote Support
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-12356CRITICALCommand Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)EPSS 87.4%KEVCVE-2026-102764CRITICALImproper Origin Validation in Internal Messaging Components of BeyondTrust Remote SupportEPSS 78.0%KEVCVE-2026-40139CRITICALCritical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.8%CVE-2026-40140HIGHHigh-Severity Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.6%CVE-2026-40141HIGHHigh-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.5%CVE-2025-0217HIGHPrivileged Remote Access Authentication BypassEPSS 0.2%