BeyondTrust Privilege Management for Windows Elevation of Privilege Vulnerability

A vulnerability allowing local authenticated attackers to elevate privileges has been identified in BeyondTrust Privilege Management for Windows, prior to version 25.4.270.0. Under certain conditions, attackers can manipulate user profile files to inject illegitimate challenge response codes into the local user registry. This exploitation enables users who can edit their profile files to gain administrator privileges.

Impact

Exploitation of this vulnerability allows for unauthorized elevation of privileges to administrator level.

Remediation

Users can upgrade to BeyondTrust Privilege Management for Windows version 25.4.270.0 or later to address this vulnerability. For versions prior to 25.4.270.0, it is recommended to avoid using 'forever' challenge response auto elevation permissions and to monitor the registry for any existing 'forever' response entries, making policy changes as needed.