CVE-2025-2297
High
Description
Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.
SeverityHigh
CVSS7.8
Exploit probability—
ProductBeyondtrust Privilege Management For Windows
PublishedJul 28, 2025
First seenJul 28, 2025
Weakness typeCWE-268CWE-268
How to fix
Update
- beyondtrust privilege_management_for_windows25.4.270 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| beyondtrust privilege_management_for_windows | v < 25.4.270 | 25.4.270 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.