A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote…

CVE-2026-40139 is a pre-authentication authentication-bypass (CWE-287) in the auth subsystem of BeyondTrust Remote Support — the appliance-based product used by IT and MSP support desks to launch privileged screen-share, file-transfer, and command-execution sessions on managed endpoints. An unauthenticated attacker who can reach the appliance's web interface over the network can forge or bypass the session-establishment handshake, land as a valid operator, and pivot into the *jump items* and *representative consoles* that already hold cached credentials to servers, workstations, and domain accounts. Affected builds are the Remote Support appliance lines shipped before the July 2026 hotfix train (the vendor advisory names the pre-fix RS 24.x / 25.x / 26.x branches — anything not on the July 6 release is presumed vulnerable).

The vendor's CRITICAL / 9.8 rating matches reality and, if anything, understates the operational impact. BeyondTrust RS is a canonical high-trust identity-adjacent component: exploiting the appliance itself is the same class of blast radius as compromising a domain controller or PAM vault, because the product's *entire job* is to hold privileged reach into the fleet. This is the same product family that was weaponized against Treasury in the December 2024 incident (CVE-2024-12356), so the threat model here is well-established and the pattern of internet-exposed RS portals is real.

Why this verdict

• Role multiplier — canonical high-value role: BeyondTrust RS *is* the privileged-access plane. The bug lives inside the component that legitimately holds SYSTEM reach into every managed endpoint. Chain ends in fleet compromise by design → floor is CRITICAL.
• Pre-auth + network-reachable: AV:N/PR:N/UI:N — no credentials, no clicks. Any exposed portal is a one-shot target.
• Historical precedent: Same product line, same bug class was exploited in the wild in December 2024 (CVE-2024-12356) and used to breach US Treasury OFAC/CFIUS workstations. Threat actors already have the tradecraft.
• Real installed base exposure: Shodan/Censys show thousands of externally reachable RS portals — customer-facing portal exposure is architecturally intended, so this isn't a misconfiguration edge case.
• No compensating friction breaks the floor: WAF and network segmentation are possible but rarely deployed in front of vendor-supplied appliances; EDR fires on post-exploitation, not on the initial auth bypass.

Why not higher?

CRITICAL / 9.8 is already the top of the CVSS v3.1 scale for this vector. No public PoC and no confirmed in-the-wild exploitation yet keep this from being an emergency-hours-not-days scramble — but that gap is measured in days, not months.

Why not lower?

Any downgrade would require either (a) evidence the exposed installed base is <1% — contradicted by Shodan data, or (b) that the appliance doesn't actually hold privileged endpoint reach — contradicted by the product's core function. Neither applies. Downgrade to HIGH would ignore the role multiplier that makes this a fleet-compromise chain.

1. Restrict RS appliance web tier to VPN/ZTNA immediately — Deploy within 3 days per the noisgate mitigation SLA for CRITICAL. Put the operator console and API paths behind a corporate VPN, Cloudflare Access, Zscaler ZPA, or equivalent identity-aware proxy. Customer-facing session-request portal can be restricted to known partner IP ranges via WAF allowlist.
2. Block known exploit patterns at WAF — Deploy vendor and Cloudflare/F5/AWS managed rule updates as they release. Rules typically land 48-72h post-disclosure; enable in block mode after 24h monitoring.
3. Alert on any new RS operator account creation and off-hours operator logins — Forward RS audit logs to SIEM. Baseline your operator population and alert on new accounts, new source IPs, or sessions initiated outside business hours. This catches post-exploit persistence.
4. Rotate all credentials cached in RS Credential Vault — Assume compromise until you've confirmed the appliance was not exploited. Rotate any service accounts, local admin creds, and privileged accounts that RS holds — priority on domain-privileged creds.
5. Deploy vendor hotfix — Apply the July 6 hotfix within 90 days per the noisgate remediation SLA for CRITICAL, but there's no reason to wait — this should be a same-week change for internet-exposed appliances.
6. Audit jump-client inventory and reduce SYSTEM reach where possible — Even after patching, remove jump clients from Tier-0 assets (DCs, PKI, backup servers) unless there's an active business need. Reduces blast radius for the next RS bug.

Run this from an auditor workstation with network reach to the RS appliance (VPN or admin subnet). Requires curl and openssl. Usage: ./check-rs.sh https://support.example.com — no credentials needed; the script only inspects the login page banner and TLS cert to identify build. For authoritative version detection, cross-reference the vendor's appliance /appliance/api/version endpoint if you have admin creds.

#!/usr/bin/env bash
# noisgate CVE-2026-40139 BeyondTrust Remote Support version check
# Usage: ./check-rs.sh <https-url>
# Output: VULNERABLE | PATCHED | UNKNOWN
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "usage: $0 https://support.example.com" >&2
  exit 2
fi

# Fixed build (July 2026 hotfix train) — update as vendor publishes exact build numbers
FIXED_BUILD_MIN="26.1.1"

# Grab login page + headers
RESP=$(curl -sk --max-time 15 -D - "$TARGET/login" 2>/dev/null)
if [[ -z "$RESP" ]]; then
  echo "UNKNOWN: no response from $TARGET"
  exit 3
fi

# Confirm it's actually BeyondTrust RS
if ! echo "$RESP" | grep -qiE 'BeyondTrust|Bomgar|Remote Support'; then
  echo "UNKNOWN: target does not appear to be BeyondTrust Remote Support"
  exit 3
fi

# Try to extract build/version from footer or /appliance page
VER=$(curl -sk --max-time 15 "$TARGET/appliance" 2>/dev/null | \
  grep -oiE 'version[^0-9]{0,10}[0-9]+\.[0-9]+\.[0-9]+' | head -1 | \
  grep -oE '[0-9]+\.[0-9]+\.[0-9]+')

if [[ -z "$VER" ]]; then
  VER=$(echo "$RESP" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
fi

if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not extract version from $TARGET — verify via admin console"
  exit 3
fi

# Semver compare
vergte() { [ "$1" = "$(printf '%s\n%s' "$1" "$2" | sort -V | tail -1)" ]; }

if vergte "$VER" "$FIXED_BUILD_MIN"; then
  echo "PATCHED: $TARGET reports $VER (>= $FIXED_BUILD_MIN)"
  exit 0
else
  echo "VULNERABLE: $TARGET reports $VER (< $FIXED_BUILD_MIN) — CVE-2026-40139"
  exit 1
fi

Sources

1. BeyondTrust Trust Center — Security Advisories
2. CISA KEV Catalog
3. NVD — CVE-2026-40139
4. FIRST EPSS
5. CISA advisory on CVE-2024-12356 (BeyondTrust RS, prior incident precedent)
6. watchTowr Labs research on BeyondTrust RS
7. Shodan — BeyondTrust product footprint
8. MITRE CWE-287 Improper Authentication