BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA

BeyondTrust has released updates to address two critical security flaws affecting Remote Support (RS) and Privileged Remote Access (PRA) products that, if successfully exploited, could allow unauthenticated attackers to take control of susceptible devices. The vulnerabilities are listed below - CVE-2026-40138 (CVSS score: 9.2) - A pre-authentication vulnerability exists in the

The reported BeyondTrust flaws are critical pre-authentication vulnerabilities in Remote Support (RS) and Privileged Remote Access (PRA) that allow unauthenticated remote attackers to execute OS commands or bypass authentication, leading to full system compromise on exposed management appliances.[2][4] According to advisories, these products are widely deployed, internet-facing in many environments, and used for privileged access and remote administration, making them high-value targets for attackers.[2][4] From a RealGround perspective, any AI agents or LLM-based operations that rely on BeyondTrust RS/PRA as part of their privileged access, support workflows, or MLOps infrastructure inherit this risk through the AI supply chain: compromise of these tools could give attackers a pathway to AI backends, model servers, or sensitive data stores controlled via those remote access channels. Practically, organizations should inventory and patch all RS/PRA instances, incorporate these components into SBOMs and AI system diagrams, and enforce network segmentation and least-privilege controls around remote access tools that interact with AI infrastructure to prevent a single appliance exploi