CVE-2025-2297 - Privilege Management for Windows - Elevation of Privilege

Back Back to CVE browser

HIGH

Privilege Management for Windows - Elevation of Privilege

Published Jul 28, 2025

7.2

HIGH

CVSS 4.0

EPSS 0.13%

Description

Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.

Affected products

Vendor BeyondTrust Product Privilege Management for Windows Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <<25.4.270

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

BeyondTrust

Privilege Management for Windows

unaffected

Version	Status	Constraints
0	affected	<<25.4.270

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-268

References (1)

https://www.beyondtrust.com/trust-center/security-advisories/bt25-05
Vendor Advisory

Link	Providers	Tags
https://www.beyondtrust.com/trust-center/security-advisories/bt25-05		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner BT

Published Jul 28, 2025

Updated Jul 28, 2025

Reserved Mar 13, 2025

Link CVE-2025-2297

CISA Vulnrichment

Updated Jul 28, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-2297

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-2297