A critical flaw in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access incorrectly handles authentication requests, enabling an unauthenticated attacker to bypass login controls and gain elevated access to the appliance. The weakness is identified as an authentication bypass (CWE‑287).

Both BeyondTrust Privileged Remote Access and BeyondTrust Remote Support are affected; the advisory does not limit the issue to particular software versions, so any current installation may be vulnerable if the affected authentication configuration is enabled

The flaw carries a CVSS score of 9.2, classifying it as critical. The EPSS score is below 1 %, indicating a very small probability of exploitation in the wild at the current moment, and the vulnerability is not listed in CISA KEV. Nevertheless, the attack can be performed by an unauthenticated remote attacker once the vulnerable authentication configuration is enabled. The attacker could bypass login controls over the network and gain privileged access to the appliance, potentially allowing full control of the device, data disclosure, or a pivot to other systems. Because the vulnerability is pre‑authentication, no user credentials are required, and exploitation merely requires the presence of the vulnerable authentication configuration.