A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote…

CVE-2026-40138 is a pre-authentication bypass in the authentication subsystem of BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) — the product line whose entire job is brokering privileged sessions into critical infrastructure. A network-positioned attacker sending crafted authentication data can bypass access controls and land on the appliance as an existing account, including administrative ones. Affected: RS and PRA at 25.3.2 and earlier; fixed in 25.3.3. Cloud tenants were patched April 21, 2026; self-hosted appliances remained exposed until the coordinated July 6, 2026 disclosure. Exploitation requires a specific authentication configuration to be enabled — that condition is what earned it AC:H and shaved the vendor CVSS to 8.1.

The vendor label of HIGH (8.1) is defensibly conservative but operationally wrong for defenders. Third-party trackers (Halo, Beazley, CyCognito, The Hacker News) uniformly cite CVSS 9.2 and describe the flaw as *critical*. More importantly, CVSS does not model *role*: this bug lives inside the identity-brokering plane. A compromised RS/PRA appliance yields active jump sessions, stored credentials, and vendor-remote-support pathways into the very hosts the customer considered their crown jewels. That is not a HIGH — that is a CRITICAL by role multiplier alone.

Why this verdict

• Role multiplier — canonical PAM/privileged-access-broker: The bug is in the authentication subsystem of a product whose entire deployment role is *holding credentials for the crown jewels*. Chain succeeds → attacker inherits the appliance's vault, jump items, and vendor pathways. 100% of installs occupy the high-value role by definition. Floor is CRITICAL.
• Pre-auth (PR:N) network-reachable (AV:N): No credential harvesting or phishing precondition. Even AC:H does not soften this materially — the AC:H is a configuration precondition, not a race or timing constraint.
• Prior pattern for this product line: CVE-2024-12356 and CVE-2025-1731 both moved from disclosure to weaponized exploitation quickly; CVE-2024-12356 hit CISA KEV. Threat actors (notably the Salt Typhoon / US Treasury incident cluster) have historically targeted BeyondTrust specifically.
• Silent-patch cloud disclosure gap: BeyondTrust patched cloud on 2026-04-21 and disclosed on 2026-07-06 — a 76-day window in which patch diffs of the cloud-deployed binaries were technically reachable by determined actors. Assume advanced actors already have a working primitive.
• Downward pressure acknowledged but not sufficient to break floor: AC:H (specific auth config required) and the cloud-remediated majority narrow the reachable population — but self-hosted RS/PRA is the *higher-value* deployment mode (regulated industries, vendor-remote-support into OT). Adjustment: reassessed 9.4 vs. vendor 8.1.

Why not higher?

A 10.0 would require confirmed in-the-wild exploitation and a public PoC. Neither exists as of 2026-07-17, and the AC:H configuration prerequisite legitimately eliminates some deployments. 9.4 leaves room to move to 9.8+ once a PoC drops or CISA KEV-lists.

Why not lower?

Downgrading below CRITICAL would require the affected component to be low-value or the exposed population to be measured in tenths of a percent. Neither applies: RS/PRA is a canonical PAM broker (role floor = CRITICAL per noisgate policy), and Censys/Shodan show a nontrivial internet-facing self-hosted population. The AC:H friction can lift the number above the floor but cannot pull it under.

1. Front the appliance with strict source-IP allowlisting — Restrict TCP/443 to the CIDR blocks of your operator VPN, vendor-technician IPs, and customer-portal jump hosts. Deploy within 3 days per the noisgate CRITICAL mitigation SLA. Effective because the flaw requires reaching the login surface — most orgs allow the world to reach it by default.
2. Disable the vulnerable authentication configuration flagged in BT26-03 — If your deployment can operate with SAML/SSO-only auth, disable the affected mode entirely. This kills the exploitation prerequisite outright. Do this within 3 days even before you install 25.3.3.
3. Rotate all vaulted credentials and jump-item secrets after patching — Assume the appliance is compromised. Rotate service accounts, break-glass credentials, network-device local admins, and any secrets accessible via RS/PRA vault entries. Sequence rotation *after* upgrade to 25.3.3 within the 90-day noisgate remediation window.
4. Enable dual-control session approval on all jump groups — Force a second admin to approve each session initiation. Attackers holding an admin token still cannot silently launch jumps into DCs, hypervisors, or OT segments. Enable within 3 days as a defense-in-depth measure while patching rolls out.
5. Ship RS/PRA audit logs to the SIEM and hunt — Ingest appliance auth logs and admin-action logs. Hunt for admin logins from unusual source IPs, off-hours jump-item enumeration, and any session initiated without a corresponding ticket. Baseline is 30 days of operator behavior.

Run from an auditor workstation with network reachability to the appliance. Invoke as ./check_bt2640138.sh https://support.example.com — no credentials required; the check reads the version banner from the public login page. Requires curl and grep.

#!/usr/bin/env bash
# noisgate — CVE-2026-40138 / BT26-03 exposure check
# Detects vulnerable BeyondTrust RS/PRA versions (<= 25.3.2).
# Usage: ./check_bt2640138.sh <https://appliance-url>
set -u

if [[ $# -lt 1 ]]; then
  echo "Usage: $0 <https://appliance-url>" >&2
  exit 2
fi

TARGET="${1%/}"
UA="noisgate-bt26-03/1.0"

# Fetch appliance login page and API version endpoint.
BODY=$(curl -sk -A "$UA" --max-time 10 "$TARGET/api/config/getSupportInfo" 2>/dev/null)
if [[ -z "$BODY" ]]; then
  BODY=$(curl -sk -A "$UA" --max-time 10 "$TARGET/appliance/login.ns" 2>/dev/null)
fi

if [[ -z "$BODY" ]]; then
  echo "UNKNOWN: could not reach $TARGET (network / TLS / not a BeyondTrust appliance)"
  exit 3
fi

# Extract version — appears as e.g. "25.3.2" in HTML/JSON.
VER=$(printf '%s' "$BODY" | grep -oE '"?version"?[[:space:]:="]*[0-9]+\.[0-9]+\.[0-9]+' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
if [[ -z "$VER" ]]; then
  VER=$(printf '%s' "$BODY" | grep -oE '[0-9]{2}\.[0-9]+\.[0-9]+' | head -n1)
fi

if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not fingerprint version at $TARGET"
  exit 3
fi

# Vulnerable if <= 25.3.2. Simple version comparison via sort -V.
LOWEST_FIXED="25.3.3"
OLDER=$(printf '%s\n%s\n' "$VER" "$LOWEST_FIXED" | sort -V | head -n1)

if [[ "$VER" == "$LOWEST_FIXED" ]] || [[ "$OLDER" == "$LOWEST_FIXED" ]]; then
  echo "PATCHED: $TARGET is at $VER (>= $LOWEST_FIXED)"
  exit 0
else
  echo "VULNERABLE: $TARGET is at $VER (<= 25.3.2) — CVE-2026-40138 exposure; upgrade to $LOWEST_FIXED or apply April rollup"
  exit 1
fi

Sources

1. BeyondTrust BT26-03 advisory
2. BleepingComputer — BeyondTrust warns of critical flaws
3. The Hacker News — BeyondTrust patches critical auth bypass
4. Halo Security CVE advisory — CVE-2026-40138
5. Tenable CVE record
6. Beazley Security alert — CVE-2026-40138 / 40139
7. CyCognito emerging-threat blog
8. SOCRadar — BeyondTrust fixes RS/PRA CVE-2026-40138