Cyber Exposure Management: BeyondTrust EPM Flaws Explained

Cyber exposure management is especially useful when a newly disclosed vulnerability affects software designed to control endpoint privileges. BeyondTrust has disclosed two vulnerabilities in Endpoint Privilege Management (EPM) for Windows, CVE-2026-40144 and CVE-2026-40145, affecting versions before 26.1.2. The issues can create local privilege-escalation and protection-bypass risks, making them relevant to endpoint security, vulnerability management, supplier assessments, and broader third-party risk decisions.

What Happened With the BeyondTrust EPM Vulnerabilities?

BeyondTrust disclosed the vulnerabilities in security advisory BT26-04 on August 17, 2026. The affected product is Endpoint Privilege Management for Windows deployments, with versions before 26.1.2 identified as affected. A Canadian Cyber Centre advisory published August 18 also directs administrators to review the BeyondTrust advisory and apply necessary updates.

The two vulnerabilities have different technical characteristics.

CVE-2026-40144 carries a CVSS v4 score of 7.3. It involves a memory-corruption condition in a kernel-mode EPM component caused by insufficient input validation. Public reporting describes local access and low privileges as requirements, meaning this is not a simple remotely exploitable internet-facing vulnerability.

CVE-2026-40145 carries a CVSS v4 score of 7.1 and involves insufficient access-control granularity affecting the EPM Windows support utility and anti-tamper controls. The vulnerability requires local access and elevated privileges, along with additional endpoint conditions.

BeyondTrust has stated that it found no evidence that either vulnerability was exploited before remediation. That distinction matters. A vulnerable installation is not the same thing as a confirmed compromise.

Why Local Privilege Escalation Still Matters

A vulnerability that requires local access can initially appear less concerning than a remotely exploitable flaw. In enterprise environments, however, local privilege escalation can become important when an attacker already has some form of foothold.

For example, an endpoint may already be affected by malware, a compromised user account, or another security weakness. If a local privilege-escalation vulnerability is available, it can potentially change the level of control available to an attacker.

That does not mean CVE-2026-40144 or CVE-2026-40145 has been used in such an attack chain. It means security teams should understand where the vulnerable software sits and what privileges, applications, identities, and business resources are connected to those endpoints.

This is where cyber exposure management provides useful context beyond a simple CVE list.

Cyber Exposure Management Should Connect Vulnerabilities to Assets

A vulnerability scanner can identify an affected product version. Cyber exposure management asks what that finding means in the environment around it.

Security teams should establish:

• Which Windows endpoints run EPM versions before 26.1.2.
• Which systems have already been updated.
• Whether vulnerable endpoints are used by privileged users.
• Whether affected systems connect to sensitive applications or infrastructure.
• Whether endpoint detection tools show unusual process or privilege activity.
• Whether local administrator access is restricted.
• Whether affected systems belong to critical business functions.
• Whether the deployment is managed internally or by a third-party provider.

This creates a more useful risk picture.

An affected EPM installation on an ordinary workstation and an affected installation used by an administrator managing sensitive infrastructure should not necessarily receive identical treatment.

The CVSS score provides standardized severity information. Asset criticality, identity exposure, privilege, connectivity, and business dependency provide the context needed for prioritization.

What Security Teams Should Investigate

The first priority is straightforward: identify affected versions and move to the vendor-recommended fixed release.

BeyondTrust’s published information identifies version 26.1.2 as the fixed release for these EPM Windows vulnerabilities. Organizations should validate both the software version and whether the update was successfully applied rather than assuming that a deployment campaign completed successfully.

After patching, security teams can review endpoint telemetry for signs that deserve additional investigation.

Useful evidence includes:

1. Unexpected privilege changes.
2. Unusual processes running with elevated permissions.
3. Abnormal interaction with EPM components or support utilities.
4. Endpoint security alerts involving affected systems.
5. Suspicious authentication activity around privileged accounts.
6. Other vulnerabilities that could provide an initial foothold.

The investigation should remain evidence-driven. The existence of a vulnerable EPM version alone does not prove that exploitation occurred.

Why This Creates a Third-Party Cyber Risk Question

The risk changes when BeyondTrust EPM is operated by a supplier, managed service provider, IT outsourcer, or another third party.

A supplier may use EPM to manage endpoints that support your organization, but that does not automatically mean your systems or data were compromised.

Instead, vendor-risk teams should establish the actual relationship.

Questions worth asking include:

• Does the supplier use affected EPM Windows deployments?
• Which customer environments fall within the supplier’s management scope?
• Were versions before 26.1.2 deployed?
• Has the supplier completed remediation?
• Can the supplier provide evidence of the update?
• Did the supplier perform additional investigation?
• Were privileged accounts or sensitive systems involved?
• Does the vulnerability affect any service covered by contractual security requirements?

This is a more useful approach than treating every vulnerable supplier as an incident.

How an Exposed Asset Discovery Review Adds Context

Exposed asset discovery can help organizations understand the external footprint surrounding a supplier or business partner, but it should not be confused with endpoint vulnerability confirmation.

An external assessment might identify domains, subdomains, IP infrastructure, hosting relationships, open services, applications, certificates, or other publicly observable assets. Those findings can help establish the organization’s broader external attack surface.

They cannot, by themselves, prove that BeyondTrust EPM is installed on an endpoint or that CVE-2026-40144 or CVE-2026-40145 is exploitable.

That distinction is essential.

An internet-facing service is an external exposure. A vulnerable EPM installation is a software vulnerability. Exploitation is a separate event, and confirmed compromise requires stronger evidence.

Organizations can therefore combine internal vulnerability information with external attack surface intelligence rather than attempting to make one source answer every security question.

Turning Raw Findings Into a Cyber Risk Report

Raw technical data is useful to analysts, but procurement teams, executives, and vendor managers often need something different.

They need to know what the finding means, which supplier or asset is involved, what evidence supports it, and what action should happen next.

A structured Third-Party Risk Management Report can help organize those questions around:

• Supplier criticality.
• Observed external exposure.
• Relevant vulnerabilities.
• Evidence and validation status.
• Potential business relevance.
• Remediation status.
• Outstanding questions.
• Recommended follow-up.

ThreatExposure.io currently positions its reports around supplier exposure, third-party risk, attack surface visibility, findings, evidence, prioritization, and remediation context. Its site also describes report use cases spanning vendor onboarding, reassessment, procurement, governance, and supplier oversight.

A Darknetsearch.com report can therefore be relevant when an organization needs to turn external cyber-risk observations into a structured document for security, procurement, or vendor-management discussions.

How an ASM Report Supports the Investigation

An Attack Surface Management Report provides another perspective.

Rather than attempting to prove that an internal endpoint contains a particular CVE, an ASM assessment can help organizations understand externally observable assets and infrastructure associated with an organization or supplier.

ThreatExposure.io describes its current reporting approach as a passive external assessment that correlates infrastructure, applications, identities, and threat intelligence into an executive report. The site lists areas such as IPs, hosting, ASN information, open ports, applications, DNS, email, TLS/SSL, infrastructure, credentials, breach intelligence, and vulnerability-related intelligence among its report areas.

An Attack Surface Management resource from ThreatExposure.io can also provide a useful starting point for reviewing related external exposure and supply-chain security topics.

What Procurement and TPRM Teams Should Do Now

The BeyondTrust issue is a good example of why vendor assessments should connect technical findings with supplier criticality.

A practical review should include:

• Identify suppliers using BeyondTrust EPM for Windows.
• Confirm whether affected versions were deployed.
• Request remediation confirmation where appropriate.
• Determine whether affected endpoints support your organization’s services.
• Establish whether privileged access is involved.
• Review available security telemetry for suspicious activity.
• Separate vulnerability evidence from exploitation evidence.
• Review the supplier’s external attack surface when relevant.
• Document confirmed findings and unresolved questions.
• Reassess the supplier if the finding materially changes its risk profile.

This approach supports better security risk management because it prevents a technical vulnerability from becoming either an ignored finding or an exaggerated incident claim.

Frequently Asked Questions

Are the BeyondTrust EPM vulnerabilities actively exploited?

BeyondTrust stated that it found no evidence that CVE-2026-40144 or CVE-2026-40145 had been exploited before remediation. Public reporting reviewed for this article does not establish active exploitation. Organizations should still patch affected EPM Windows deployments and investigate suspicious endpoint activity based on their own telemetry.

Which BeyondTrust EPM versions are affected?

BeyondTrust Endpoint Privilege Management for Windows deployments before version 26.1.2 are identified as affected by CVE-2026-40144 and CVE-2026-40145. Organizations should verify their deployed version directly and follow the vendor’s current security guidance rather than relying on an inventory record that may be outdated.

Can an ASM Report prove that a supplier was compromised?

No. An ASM Report provides external exposure information and can help identify assets, services, infrastructure, and other security signals. It does not automatically prove exploitation or compromise. Confirming an incident requires appropriate evidence, such as endpoint telemetry, forensic findings, incident-response data, or a reliable disclosure.

How should third-party teams assess a vulnerable supplier?

Start by confirming whether the supplier actually uses the affected technology and whether the vulnerable deployment is within the services supporting your organization. Then validate remediation, assess privilege and business criticality, review available evidence, and document residual risk. External attack surface findings can complement, rather than replace, direct supplier due diligence.

Assess Third-Party Exposure With a Structured Report

A vulnerability such as CVE-2026-40144 or CVE-2026-40145 is most useful when security teams can connect it to real assets, privileges, suppliers, and business dependencies. A structured report can help procurement, TPRM, security, and executive stakeholders understand what has been observed and what requires follow-up.

ThreatExposure.io’s third-party cyber risk reports help turn external exposure findings into practical supplier-risk insights for security, procurement, and vendor-management teams. Try ThreatExposure.io for free and see how external cyber risk information can support better-informed security decisions.

Disclaimer: Threatexposure reports on publicly available threat-intelligence sources. Inclusion of an organization in an article does not imply confirmed compromise. All claims are attributed to external sources unless explicitly verified.