CVE-2025-6250: BeyondTrust Privilege Management For Windows

Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days.

Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions.

Affected products

• BeyondTrust Privilege Management For Windows: before 25.4.270 (fixed in 25.4.270)

Published 2025-07-28. Last modified 2026-06-17.