Vulnerability

CERT-In Vulnerability Note CIVN-2026-0375
Multiple Vulnerabilities in BeyondTrust

Original Issue Date:July 22, 2026

Severity Rating: CRITICAL

Software Affected

BeyondTrust Remote Support versions RS 25.3.2 or lower
BeyondTrust Privileged Remote Access versions PRA 25.3.2 or lower

Overview

Multiple vulnerabilities have been reported in BeyondTrust Remote Support (RS) and Privilege Remote Access (PRA), which could allow an attacker to bypass authentication, gain unauthorized access, cause denial-of-service conditions, access unintended resources on the targeted system.

Target Audience:
All end-user organizations and individuals using BeyondTrust.

Risk Assessment:
High risk of denial-of-service, bypass security restrictions, sensitive information disclosure.

Impact Assessment:
Potential for denial-of-service, bypass security restrictions, sensitive information disclosure and/or compromise of system.

Description

BeyondTrust Remote Support (RS) and Privilege Remote Access (PRA) are secure remote access and privileged access management solutions used to provide and manage remote administrative access.

Multiple vulnerabilities have been reported in BeyondTrust due to improper authentication, uncontrolled resource consumption, and improper neutralization of special elements in data query logic. An attacker could exploit these vulnerabilities to bypass authentication, trigger denial-of-service conditions, or access resources beyond their authorization scope on the targeted system.

Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access, access sensitive information, elevate privileges under specific configurations, disrupt service availability, and potentially compromise the targeted system.

Solution

Apply appropriate updates as mentioned by the vendor:
https://www.beyondtrust.com/trust-center/security-advisories/bt26-03

Vendor Information

BeyondTrust
https://www.beyondtrust.com/

References

https://www.beyondtrust.com/trust-center/security-advisories/bt26-03

CVE Name
CVE-2026-40138
CVE-2026-40139
CVE-2026-40140
CVE-2026-40141

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India