What’s Vulnerable › Vulnerabilities
CVE-2025-2297: Privilege Management for Windows - Elevation of Privilege
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-07-28 · updated 2026-06-17
- Weakness: CWE-268
Description
Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.
Affected products
- BeyondTrust Privilege Management for Windows: before 25.4.270 — fixed in 25.4.270
How to fix
Upgrade to a fixed version: BeyondTrust Privilege Management for Windows 25.4.270. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-2297 or the next vulnerability affects your stack