CVE-2026-40140
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A vulnerability in BeyondTrust Remote Support and Privileged Remote Access allows an unauthenticated remote attacker to trigger a denial-of-service (DoS) condition due to insufficient validation of client-supplied input in the network communication subsystem.
Risk Assessment
The attack can disrupt appliance availability, preventing remote support and privileged access, leading to operational downtime and potential financial losses.
Recommendation
Immediately apply the patch provided by BeyondTrust and restrict network interface access to trusted IP addresses only.
Other vulnerabilities in BeyondTrust Remote Support
See all- CVE-2026-40141Critical
A high-severity vulnerability was found in the web application component of BeyondTrust Remote Support and Privileged Remote Access related to input parameter processing. Insufficient input validation may allow an authenticated attacker with limited privileges to access unauthorized resources or data beyond their scope.
- CVE-2026-40139Critical
A critical pre-authentication vulnerability in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.
Original NVD description (English source)
BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.