BeyondTrust Warns of Critical PAM Bypass Flaws

BeyondTrust, a leading provider of Privileged Access Management (PAM) solutions, has disclosed four vulnerabilities in its Remote Support (RS) and Privileged Remote Access (PRA) products. The vulnerabilities, including two critical pre-authentication bypass flaws rated 9.2 on CVSS v4, affect self-hosted customers on version 25.3.2 or earlier who are not enrolled in automatic updates.

The urgency of the situation is not just about the flaws themselves, but also the critical role that PAM platforms like BeyondTrust play in an organization's trust hierarchy. A CVSS 9.2 pre-authentication bypass in a standard web application is a serious problem bounded by that application's data. The same bypass in a PAM gateway, however, inherits the trust of every managed system, making a single successful exploit attempt grant access to all systems.

Cloud-hosted customers were patched silently on April 21, 2026, but self-hosted customers remain exposed and are urged to patch immediately to avoid administrative control of all managed systems. The vulnerability highlights the importance of timely patching and updates in maintaining the security of critical systems.

As the incident unfolds, it remains to be seen how organizations will respond to the vulnerability and what measures they will take to mitigate the risk. One thing is certain, however, the vulnerability serves as a stark reminder of the importance of robust security measures in protecting against sophisticated threats.