CVE-2026-40145

Published Aug 17, 2026

Last updated 2 months ago

CVSS high 7.1
Beyondtrust

Overview

Description
A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deployment) support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended.
Source
13061848-ea10-403d-bd75-c83a022c2891
NVD status
Awaiting Analysis

Risk scores

CVSS 4.0

Type
Secondary
Base score
7.1
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
HIGH

Weaknesses

13061848-ea10-403d-bd75-c83a022c2891
CWE-1220

Social media

Hype score
Not currently trending

  1. BeyondTrust Windows EPM の脆弱性 CVE-2026-40144／40145 が FIX：深刻な権限昇格の恐れ https://t.co/Kx4GT058GV BeyondTrust Endpoint Privilege Management (Windows Deployment) における、特権制御処理に対する非検証の問題が生じています。こ

    @iototsecnews

    27 Aug 2026

    44 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. BeyondTrust patched two high-severity EPM flaws (CVE-2026-40144, CVE-2026-40145) allowing local privilege escalation on Windows. Update to 26.1.2. #BeyondTrust #CVE202640144 #PrivilegeEscalation #Windows #EndpointSecurity #InfoSec https://t.co/E7oWVkf9e5

    @Daily_CyberSec

    19 Aug 2026

    206 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability•CVE-2026-102764
  2. A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior to version 26.1.2. Insufficient validation of input processed by the component may result in memory being accessed outside its intended bounds.•CVE-2026-40144
  3. BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.•CVE-2026-40140
  4. A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated attacker with limited privileges to access unintended resources or data beyond their authorization scope. Exploitation is restricted to accounts with specific permissions.•CVE-2026-40141
  5. A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled•CVE-2026-40138

References

Sources include official advisories and independent security research.