CVE-2025-2297: BeyondTrust Privilege Escalation Flaw

CVE-2025-2297 Overview

CVE-2025-2297 is a local privilege escalation vulnerability in BeyondTrust Privilege Management for Windows. A local authenticated attacker can manipulate user profile files to inject illegitimate challenge response codes into the local user registry. Under certain conditions, this allows a standard user who can edit their own profile files to elevate privileges to administrator. The flaw is tracked under CWE-268: Privilege Chaining and affects versions prior to 25.4.270.0.

Critical Impact
Authenticated local users can escalate to administrator on affected endpoints, undermining the least-privilege enforcement that Privilege Management for Windows is deployed to provide.

Affected Products

BeyondTrust Privilege Management for Windows versions prior to 25.4.270.0
Endpoints where users have write access to their own user profile files
Windows systems relying on Privilege Management for Windows challenge/response workflows

Discovery Timeline

2025-07-28 - CVE-2025-2297 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2297

Vulnerability Analysis

BeyondTrust Privilege Management for Windows enforces least-privilege policies and supports challenge/response codes as an out-of-band mechanism for granting temporary elevation. The product stores state related to these challenge response codes in the local user registry, seeded in part from data present in user profile files.

Prior to version 25.4.270.0, the product trusted values retrieved from writable user profile files without sufficient validation. A local authenticated attacker with the ability to edit those profile files can insert crafted challenge response codes that the agent then honors as legitimate. The result is that a standard user obtains administrator-level rights on the local system.

The issue is a chained privilege escalation ([CWE-268]) rather than a memory-safety or injection flaw. Exploitation requires local access, low privileges, and specific preconditions on the target, which is reflected in the attack complexity of the vulnerability.

Root Cause

The root cause is improper trust of user-controlled input. Privilege Management for Windows reads challenge response data from user profile files that fall within the attacker's write scope and promotes those values into the local user registry. Because the agent uses the injected codes to authorize elevation decisions, an attacker controls a security-relevant input path.

Attack Vector

Exploitation is local and requires an authenticated session on the target endpoint. The attacker modifies their own user profile files to include illegitimate challenge response codes, triggers the Privilege Management for Windows workflow that consumes them, and receives administrator privileges. No user interaction from another account is required. Consult the BeyondTrust Security Advisory BT25-05 for vendor-specific technical detail.

No verified public proof-of-concept code is available at the time of writing, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-2297

Indicators of Compromise

Unexpected modifications to user profile files associated with Privilege Management for Windows on endpoints running versions earlier than 25.4.270.0.
Local user registry entries containing challenge response codes that were not issued through the sanctioned BeyondTrust workflow.
Standard user accounts appearing in the local Administrators group without a corresponding authorized elevation request.

Detection Strategies

Monitor file writes to Privilege Management for Windows user profile paths performed by non-administrative processes.
Correlate registry writes to Privilege Management for Windows keys with the audited source of the associated challenge response request.
Alert on new local administrator group membership changes on endpoints where Privilege Management for Windows enforces least privilege.

Monitoring Recommendations

Forward endpoint process, file, and registry telemetry to a centralized analytics platform and retain it long enough to reconstruct elevation events.
Baseline normal Privilege Management for Windows challenge/response activity per user and alert on deviations such as elevations occurring without a corresponding help-desk ticket.
Review Privilege Management for Windows audit logs regularly for elevation events attributed to standard users on unpatched hosts.

How to Mitigate CVE-2025-2297

Immediate Actions Required

Upgrade BeyondTrust Privilege Management for Windows to version 25.4.270.0 or later on all managed endpoints.
Inventory endpoints still running vulnerable versions and prioritize systems used by higher-risk user populations such as developers and administrators.
Audit local administrator group membership on affected endpoints and revoke any unauthorized additions.

Patch Information

BeyondTrust addressed the vulnerability in Privilege Management for Windows version 25.4.270.0. Full remediation details are published in BeyondTrust Security Advisory BT25-05. Apply the vendor-supplied update through your standard software distribution workflow and validate agent version reporting after deployment.

Workarounds

Restrict write permissions on Privilege Management for Windows user profile files so that standard users cannot modify security-relevant fields.
Reduce reliance on challenge/response elevation on unpatched systems and prefer policy-based elevation rules that do not consume user-writable input.
Increase audit logging around elevation events and require ticket correlation for any administrator-level action originating from a standard user account.

bash

# Verify installed Privilege Management for Windows version on a target host
Get-ItemProperty "HKLM:\SOFTWARE\Avecto\Privilege Guard Client" | Select-Object -Property Version

# Enumerate local administrators for post-patch validation
Get-LocalGroupMember -Group "Administrators"