Beyond Trust Patches Critical Auth Bypass Flaws in Remote Support and PRA
Summary: BeyondTrust released updates for two critical flaws in its Remote Support and Privileged Remote Access products that could let unauthenticated attackers take control of susceptible devices, with exploitation of CVE-2026-40138 and CVE-2026-40139 depending on a specific authentication configuration being enabled. BeyondTrust said it found the issues internally through ongoing security assessments using publicly available AI models including Anthropic Claude Opus 4.8 and its own research tooling, and made no mention of exploitation in the wild.
Bottom line: These are the same RS and PRA products whose earlier flaws, CVE-2024-12356 and CVE-2026-1731, were repeatedly exploited to deploy web shells and backdoors - so the patch window on an unauthenticated access bypass is the interval in which your privileged access appliance is the target.