CVE-2025-2297

7.2 highEPSS 0.1%

High (7.2) in beyondtrust privilege management for windows. EPSS 0.1% chance of exploitation in the next 30 days.

Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.

Severity

CVSS 4.0

7.2 high

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-31)
CWE: CWE-268
Published: 2025-07-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

beyondtrust:privilege_management_for_windows

References

https://www.beyondtrust.com/trust-center/security-advisories/bt25-05

Check your stack JSON