BeyondTrust Fixes Critical Auth Bypass Flaws

Robert Moore · 2026-07-07

BeyondTrust has released updates to patch two critical security vulnerabilities in their Remote Support (RS) and Privileged Remote Access (PRA) products. These flaws, if exploited, could let unauthenticated attackers take over affected systems. You need to act fast to keep your infrastructure safe. ### What Are the Vulnerabilities? The issues are serious. Here is a breakdown: - **CVE-2026-40138 (CVSS score: 9.2)** – A pre-authentication vulnerability exists in the command injection endpoint. Attackers can bypass authentication and execute arbitrary commands without any credentials. This is a remote code execution risk that scores near the maximum on the severity scale. - **CVE-2026-40139 (CVSS score: 8.1)** – A second flaw allows attackers to escalate privileges through a weak session management mechanism. Once inside, they can move laterally across your network. Both vulnerabilities affect versions prior to the latest patches. BeyondTrust has confirmed no active exploits in the wild yet, but that could change quickly. ### Why This Matters for Your Business Remote support tools are a lifeline for IT teams. But they also create a massive attack surface. Think of it like leaving your front door unlocked while you are on vacation. These flaws let bad actors waltz right in without a key. If you use BeyondTrust RS or PRA, your entire remote access infrastructure is at risk. > "Pre-authentication flaws are the worst kind because they require zero user interaction. Attackers just need network access to compromise your systems." – Robert Moore, Lead Antidetect Browser Specialist ### What You Should Do Now Here are three steps to protect yourself: 1. **Update immediately** – Apply the patches BeyondTrust released. Check your version against the advisory. Do not delay. 2. **Review access logs** – Look for suspicious activity in your RS and PRA environments. Unauthorized logins or unusual command executions are red flags. 3. **Segment your network** – Limit which systems can reach your remote support servers. Use firewalls to restrict access to trusted IP addresses only. ### The Bigger Picture: Why Antidetect Browsers Matter Here This news hits close to home for anyone using antidetect browsers. See, antidetect tools help you manage multiple identities and stay anonymous online. But if your remote access software has vulnerabilities like these, all that privacy work goes out the window. Attackers can hijack your sessions and steal your fingerprint data. That is why you need to pair antidetect browsers with solid security practices. Always patch your tools. Use strong authentication. And never assume your setup is bulletproof. ### Final Thoughts Security patches are not optional. They are the bare minimum. BeyondTrust fixed these flaws, but the responsibility to install them rests with you. Take 10 minutes today to update your systems. Your data and your clients trust depend on it. Stay safe out there. And if you are using antidetect browsers, double-check your entire stack for vulnerabilities. It only takes one unpatched hole to bring everything down.