[CVE-2026-40138]

July 8, 2026

• BeyondTrust patched two critical pre-auth flaws in Remote Support (RS) and Privileged Remote Access (PRA), including CVE-2026-40138 (CVSS 9.2), that let unauthenticated attackers take over affected appliances. Given these products' privileged position, prioritize patching. BleepingComputer, The Hacker News · Vulnerabilities & Exploits

in Synacktiv Drops a Kerberos Reflection Bypass That Hands Attackers SYSTEM

July 7, 2026

• BeyondTrust Remote Support and PRA CVE-2026-40138 is a critical pre-authentication access-control bypass in the products' authentication subsystem — a notable target given BeyondTrust's role in privileged access (Dark Web Informer). · Vulnerabilities & Exploits

in A 16-Year-Old KVM Flaw Punches Through the Hypervisor Boundary