CVE-2025-6250

HIGH

Privilege Management for Windows - Elevation of Privilege

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-6250 has a selected CVSS score of 7.1 (high).

Description

Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 28, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Privilege Management for Windows

Browse BeyondTrust / Privilege Management for Windows

Default status: unaffected

CVE ListBefore <25.4.270affected

References

2