CVE-2025-2297: high-severity vulnerability in BeyondTrust Privilege Management for Windows
Privilege Management for Windows - Elevation of Privilege
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 0.1%
Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
BeyondTrust · Privilege Management for WindowsRelated CVEs — BeyondTrust Privilege Management for Windows
In the same product, most dangerous first.