--- title: BeyondTrust warns of critical flaws in remote access... description: BeyondTrust has disclosed two critical vulnerabilities (CVE-2026-40138 and CVE-2026-40139) in its Remote Support (RS) and Privileged Remote Access (PRA)... canonical: https://daily.dev/posts/beyondtrust-warns-of-critical-flaws-in-remote-access-software-j3jfbhals twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: BeyondTrust warns of critical flaws in remote access software | daily.dev og:description: BeyondTrust has disclosed two critical vulnerabilities (CVE-2026-40138 and CVE-2026-40139) in its Remote Support (RS) and Privileged Remote Access (PRA)... og:url: https://daily.dev/posts/beyondtrust-warns-of-critical-flaws-in-remote-access-software-j3jfbhals og:image: https://api.daily.dev/og/posts/J3jFbhals.png og:image:alt: BeyondTrust warns of critical flaws in remote access software og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # BeyondTrust warns of critical flaws in remote access software **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary BeyondTrust has disclosed two critical vulnerabilities (CVE-2026-40138 and CVE-2026-40139) in its Remote Support (RS) and Privileged Remote Access (PRA) software, both affecting versions 25.3.2 and earlier. The flaws allow unauthenticated remote attackers to bypass authentication and gain unauthorized access under specific configurations. Two additional high-severity issues (CVE-2026-40140 and CVE-2026-40141) enabling denial-of-service and unauthorized data access were also patched. Cloud customers were automatically patched on April 21, 2026; self-hosted customers must apply the April security rollup or upgrade to RS/PRA 25.3.3 or above. BeyondTrust has a history of exploited vulnerabilities, including a prior RCE flaw used in ransomware attacks and zero-days leveraged by the Chinese state-backed Silk Typhoon group to breach the U.S. Treasury Department. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Critical Fortinet sandbox bugs allow auth bypass and RCE](https://daily.dev/posts/critical-fortinet-sandbox-bugs-allow-auth-bypass-and-rce-av1wd0io9) · The Register · 0 upvotes · 0 comments - [Multiple Authenticated High and Critical Vulnerabilities in Veeam Backup & Replication](https://daily.dev/posts/multiple-authenticated-high-and-critical-vulnerabilities-in-veeam-backup-replication-sexur3y8k) · Arctic Wolf · 1 upvotes · 0 comments - [Fortinet fixes two critical RCE flaws in FortiAuthenticator and FortiSandbox](https://daily.dev/posts/fortinet-fixes-two-critical-rce-flaws-in-fortiauthenticator-and-fortisandbox-sfl19vmql) · CSO Online · 1 upvotes · 0 comments - [CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day](https://daily.dev/posts/cisa-gives-feds-3-days-to-patch-check-point-vpn-bug-exploited-as-zero-day-v4jbko8vp) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/beyondtrust-warns-of-critical-flaws-in-remote-access-software-j3jfbhals) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"BeyondTrust warns of critical flaws in remote access software","url":"https://daily.dev/posts/beyondtrust-warns-of-critical-flaws-in-remote-access-software-j3jfbhals","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/beyondtrust-warns-of-critical-flaws-in-remote-access-software-j3jfbhals"},"datePublished":"2026-07-07T08:12:36.912Z","dateModified":"2026-08-24T07:03:35.380Z","description":"BeyondTrust has disclosed two critical vulnerabilities (CVE-2026-40138 and CVE-2026-40139) in its Remote Support (RS) and Privileged Remote Access (PRA)...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3d6ae361e62c1da1e518c923b098686a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3d6ae361e62c1da1e518c923b098686a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/beyondtrust-warns-of-critical-flaws-in-remote-access-software-j3jfbhals","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vulnerability","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"BeyondTrust warns of critical flaws in remote access software"}]} ```