CVE-2025-2297: BeyondTrust Privilege Management For Windows

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.

Affected products

• BeyondTrust Privilege Management For Windows: before 25.4.270 (fixed in 25.4.270)

Published 2025-07-28. Last modified 2026-06-17.