CVE-2025-0889

HIGH

Privilege Management for Windows – Elevation of Privilege

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-0889 has a selected CVSS score of 7.2 (high).

Description

Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows installed, via the manipulation of COM objects under certain circumstances where an EPM policy allows for automatic privilege elevation of a user process.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 26, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Privilege Management for Windows

Browse BeyondTrust / Privilege Management for Windows

Default status: unaffected

CVE ListBefore 25.2affected

References

2