VulnerabilitycriticalExploited in the wild

BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA

The Hacker Newsby @TheHackersNewsJul 7, 2026 · 05:16 UTC (Jul 7, 2026)2 min read3 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-40138 CVE-2026-40139 CVE-2026-40140 CVE-2026-40141 CVE-2024-12356 CVE-2026-1731

Tags: cve-2024-12356 cve-2026-40138 cve-2026-40139 cve-2026-40140 cve-2026-40141 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2024-12356	Unauthenticated Command Injection in BeyondTrust Privileged Remote Access/Remote Support	9.8	87%	KEVPoC	Dec 17, 2024 KEV Dec 19, 2024
CVE-2026-1731	Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA	9.9	93%	KEVRansomwarePoC	Feb 6, 2026 KEV Feb 13, 2026
CVE-2026-40139 +3 related CVEs CVE-2026-40138 CVE-2026-40140 CVE-2026-40141	A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support	9.2 group max	<1%		Jul 6, 2026

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Jul 07, 2026 Vulnerability / Enterprise Security BeyondTrust has released updates to address two critical security flaws affecting Remote Support (RS) and Privileged Remote Access (PRA) products that, if successfully exploited, could allow unauthenticated attackers to take control of susceptible devices. CVE-2026-40138 (CVSS score: 9.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.