Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Multiple Vulnerabilities in BeyondTrust Products

9 July 2026

Attackers can exploit multiple vulnerabilities in BeyondTrust's Remote Support and Privileged Remote Access products to bypass access controls and gain unauthorised access, cause a denial of service, or access unintended resources. Patch immediately.

Background

BeyondTrust has released security updates to address multiple vulnerabilities (CVE-2026-40138, CVE-2026-40139, CVE-2026-40140, and CVE-2026-40141) affecting their secure remote access products, BeyondTrust Remote Support and BeyondTrust Privileged Remote Access. The vulnerabilities have Common Vulnerability Scoring System (CVSSv3.1) scores of: CVE-2026-40138 at 8.1, CVE-2026-40139 at 9.8, CVE-2026-40140 at 7.5, and CVE-2026-40141 at 9.9, out of 10.

Impact

Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to bypass access controls and gain unauthorised access to the appliance under specific configurations, trigger a denial-of-service condition, or an authenticated attacker with limited privileges to access unintended resources or data beyond their authorisation scope.

Affected Products

These vulnerabilities affect the following products:

  • BeyondTrust Remote Support versions before 25.3.3

  • BeyondTrust Privileged Remote Access versions before 25.3.3

Recommendations

Users and administrators of affected products are advised to update to the latest versions immediately.

References

https://www.beyondtrust.com/trust-center/security-advisories/bt26-03 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-40138 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-40139 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-40140 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-40141 (opens in new tab)