Control protections bypass in BeyondTrust Endpoint Privilege Management (Windows deployment) support utility
Priority LOW 32CWE-1220Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deployment) support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00155 4th percentileScored 2026-11-07
Fix Fixed Endpoint Privilege Management (Windows deployment) (BeyondTrust): 26.1.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| BeyondTrust | Endpoint Privilege Management (Windows deployment) | before 26.1.2 | 26.1.2 | Patch available | CNA |
- Endpoint Privilege Management (Windows deployment) VendorBeyondTrust Affected before 26.1.2 Fixed in 26.1.2 Patch available CNA
Remediation
- Fix · CNA Endpoint Privilege Management (Windows deployment) (BeyondTrust) Fixed in 26.1.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40145
- 2026-10-03 Alias added: GHSA-3m9q-37cm-v3j6
References
More BeyondTrust vulnerabilities
- TI-2026-01414 Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) KEVCVSS 4.0CRITICAL 9.9
- TI-2024-11463 Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA) KEVCVSS 3.1CRITICAL 9.8
- TI-2026-74999 Weak origin checks in BeyondTrust Remote Support allow file actions KEVCVSS 4.0CRITICAL 9.3
- TI-2021-02242 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer… KEVCVSS 3.1HIGH 7.8
- TI-2024-11765 Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA) KEVCVSS 3.1HIGH 7.2
- TI-2023-09461 BeyondTrust Privileged Remote Access (PRA) versions 22.2.x to 22.4.x are vulnerable to a… CVSS 3.1HIGH 7.8
Sources
- CVE-2026-40145 · CVE Program
- CVE-2026-40145 · NVD
- FIRST EPSS
- GHSA-3m9q-37cm-v3j6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences