CVE-2025-0889 - Privilege Management for Windows – Elevation of Privilege · CoreCVE

Back Back to CVE browser

HIGH

Privilege Management for Windows – Elevation of Privilege

Published Feb 26, 2025

7.2

HIGH

CVSS 4.0

EPSS 0.20%

Description

Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows installed, via the manipulation of COM objects under certain circumstances where an EPM policy allows for automatic privilege elevation of a user process.

Affected products

Vendor BeyondTrust Product Privilege Management for Windows Default
unaffected
Affected
- ≥ 0, < 25.2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
BeyondTrust	Privilege Management for Windows	unaffected	Affected ≥ 0, < 25.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-268

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-5326
Advisory
https://www.beyondtrust.com/trust-center/security-advisories/bt25-01
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-5326		Advisory
https://www.beyondtrust.com/trust-center/security-advisories/bt25-01		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner BT

Published Feb 26, 2025

Updated Feb 26, 2025

Reserved Jan 30, 2025

Link CVE-2025-0889

CISA Vulnrichment

Updated Feb 26, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-0889

Red Hat

No data

ENISA EUVD

Assigner BT

Published Feb 26, 2025

Updated Feb 26, 2025

Link EUVD-2025-5326

GitHub

No data