CVE Explorer

CVE-2026-40141

A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated attacker with limited privileges to access unintended resources or data beyond their authorization scope. Exploitation is restricted to accounts with specific permissions.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:200fd827dcbc2c19e6358a95c79db84749be2a3a960aab8f48292a4bc78c203c

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Remote Support","vendor":"BeyondTrust","versions":[{"lessThanOrEqual":"25.3.2","status":"affected","version":"0","versionType":"custom"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:5d802360264e316632c2776656aa8e57832077129381076bfb5e6ee27e3a59df · sha256:806d26b187f66bab… · /containers/cna/affected/0

{"defaultStatus":"unaffected","product":"Privilege Remote Access","vendor":"BeyondTrust","versions":[{"lessThanOrEqual":"25.3.2","status":"affected","version":"0","versionType":"custom"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:5d802360264e316632c2776656aa8e57832077129381076bfb5e6ee27e3a59df · sha256:806d26b187f66bab… · /containers/cna/affected/1

Affected products and versions

2 source assertions

{"defaultStatus":"unaffected","product":"Remote Support","vendor":"BeyondTrust","versions":[{"lessThanOrEqual":"25.3.2","status":"affected","version":"0","versionType":"custom"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:5d802360264e316632c2776656aa8e57832077129381076bfb5e6ee27e3a59df · sha256:806d26b187f66bab… · /containers/cna/affected/0

{"defaultStatus":"unaffected","product":"Privilege Remote Access","vendor":"BeyondTrust","versions":[{"lessThanOrEqual":"25.3.2","status":"affected","version":"0","versionType":"custom"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:5d802360264e316632c2776656aa8e57832077129381076bfb5e6ee27e3a59df · sha256:806d26b187f66bab… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion

{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.5,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"H…

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:5d802360264e316632c2776656aa8e57832077129381076bfb5e6ee27e3a59df · sha256:806d26b187f66bab… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-943","description":"CWE-943 Improper Neutralization of Special Elements in Data Query Logic","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:5d802360264e316632c2776656aa8e57832077129381076bfb5e6ee27e3a59df · sha256:806d26b187f66bab… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-03"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:5d802360264e316632c2776656aa8e57832077129381076bfb5e6ee27e3a59df · sha256:806d26b187f66bab… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer