BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA

Summary

BeyondTrust has patched critical vulnerabilities (CVE-2026-40138, CVE-2026-40139, CVE-2026-40140, CVE-2026-40141) in its Remote Support and Privileged Remote Access products. These flaws could allow unauthenticated attackers to gain unauthorized access or cause denial-of-service conditions. Updates are available in RS 25.3.3 and PRA 25.3.3 and above.

Key Takeaways

1. BeyondTrust has released updates to address two critical security flaws affecting Remote Support (RS) and Privileged Remote Access (PRA) products that, if successfully exploited, could allow unauthenticated attackers to take control of susceptible devices.
2. The issues have been addressed in the following versions - Remote Support RS 25.3.2 or lower (Fixed in RS 25.3.3 and above) Privileged Remote Access PRA 25.3.2 or lower (Fixed in PRA 25.3.3 and above).
3. BeyondTrust said all the identified internally as part of ongoing security assessments, with assistance using publicly available artificial intelligence (AI) models like Anthropic Claude Opus 4.8 and its own proprietary research tooling.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents technical details about security vulnerabilities and patches, citing specific CVE numbers and CVSS scores. It attributes information to the vendor, BeyondTrust, and mentions the use of AI models in security assessments, adding a layer of transparency.

Bias assessment: Technical Reporting. The article focuses on factual reporting of security vulnerabilities and their technical implications. It avoids emotional language or partisan framing, presenting information objectively from a cybersecurity perspective.

Note: This article details critical security vulnerabilities and patches. Users of BeyondTrust Remote Support and Privileged Remote Access should prioritize applying the provided updates to mitigate risks.

Credibility flag: Technical Security Advisory

Claimed Facts (6)

• This is a factual statement detailing a specific vulnerability, its identifier, severity score, and technical description.
• This provides a factual description of another specific vulnerability, including its identifier, severity, and technical impact.
• This statement factually outlines a denial-of-service vulnerability with its associated identifier and severity.
• This is a factual statement detailing a vulnerability that allows access to unintended resources, including its identifier and severity.
• This is a factual statement specifying the affected and fixed versions of the Remote Support product.
• This is a factual statement specifying the affected and fixed versions of the Privileged Remote Access product.

Opinions (5)

• This statement offers an interpretation or contextualization of the vulnerability's exploitability, which is an analytical opinion.
• This statement provides an interpretation of the conditions for exploitation, which is an analytical opinion.
• This is a quote from BeyondTrust that expresses a potential outcome, framed as a possibility ('may allow'), which leans towards an opinion or projection of risk.
• This quote from BeyondTrust outlines potential impacts, using 'may allow,' which is a projection of possibilities rather than a definitive fact.
• The phrase 'making it essential that users move quickly' is a recommendation and an opinion on the urgency of the situation.

Claims (1)

• While the use of AI is plausible, the specific mention of 'Anthropic Claude Opus 4.8' as a direct assistant in identifying these *specific* critical vulnerabilities without further substantiation or context could be considered a claim that requires more evidence to be fully verified as a direct causal factor.

Key Sources

• The Hacker News — Cybersecurity News Outlet
• BeyondTrust — Cybersecurity Vendor
• Ravie Lakshmanan — Author
• Anthropic Claude Opus 4.8 — AI Model