CVE-2025-66374: CyberArk EPM Privilege Escalation Flaw

CVE-2025-66374 Overview

CVE-2025-66374 is a local privilege escalation vulnerability in CyberArk Endpoint Privilege Manager (EPM) Agent through version 25.10.0. The vulnerability allows a local user with limited privileges to escalate their permissions to administrative level through improper policy elevation handling of Administration tasks. This represents a significant security concern as EPM is specifically designed to manage and control privileged access on endpoints.

Critical Impact

Local users can exploit misconfigured policy elevation mechanisms to gain administrative privileges on affected systems, potentially compromising the integrity of the endpoint's security controls.

Affected Products

• CyberArk Endpoint Privilege Manager Agent versions through 25.10.0
• CyberArk EPM on-premises deployments using vulnerable agent versions
• CyberArk EPM SaaS deployments with agents prior to the patched release

Discovery Timeline

• 2026-02-03 - CVE-2025-66374 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-66374

Vulnerability Analysis

This vulnerability exists within the policy elevation mechanism of the CyberArk Endpoint Privilege Manager Agent. The flaw allows local users to exploit the way Administration tasks are elevated, bypassing intended privilege restrictions. Since this requires local access with low privilege requirements and no user interaction, an attacker who has already gained initial access to a system can leverage this vulnerability to achieve full administrative control.

The impact is significant across confidentiality, integrity, and availability, as successful exploitation grants the attacker elevated privileges that can be used to access sensitive data, modify system configurations, and potentially disrupt services running on the affected endpoint.

Root Cause

The root cause stems from improper validation or enforcement within the policy elevation workflow for Administration tasks. When the EPM Agent processes elevation requests, it fails to properly verify that the requesting user has legitimate authorization for the specific administrative action. This allows a low-privileged local user to manipulate the elevation process to gain unauthorized administrative privileges.

Attack Vector

The attack requires local access to the target system with a low-privileged user account. The attacker exploits the policy elevation mechanism by submitting a specially crafted elevation request for an Administration task. Due to the improper validation in the EPM Agent, the elevation is granted without proper authorization checks.

The attack flow typically involves:

1. An attacker gains initial access to the endpoint with a low-privileged user account
2. The attacker identifies or creates an Administration task that triggers the vulnerable elevation pathway
3. The policy elevation mechanism improperly grants administrative privileges
4. The attacker now has elevated privileges on the system

For detailed technical information, refer to the CyberArk CA26-01 Advisory and the CyberArk Release Notes.

Detection Methods for CVE-2025-66374

Indicators of Compromise

• Unexpected privilege elevation events associated with EPM Agent processes
• Anomalous Administration task executions from non-administrative user accounts
• Windows Security Event logs showing privilege changes correlated with EPM Agent activity
• Unusual process creation chains originating from EPM Agent components with elevated privileges

Detection Strategies

• Monitor Windows Security Event Logs for Event ID 4672 (Special privileges assigned to new logon) associated with EPM Agent processes
• Implement behavioral detection for privilege escalation patterns involving CyberArk EPM components
• Configure SentinelOne Singularity to detect suspicious privilege elevation attempts on endpoints running EPM Agent
• Review EPM audit logs for anomalous policy elevation requests from unexpected user accounts

Monitoring Recommendations

• Enable detailed auditing for privileged access management activities on affected systems
• Configure SIEM rules to alert on unusual elevation patterns involving CyberArk EPM Agent processes
• Implement SentinelOne's real-time behavioral monitoring to detect local privilege escalation attempts
• Establish baseline behavior for EPM Agent operations to identify deviations indicative of exploitation

How to Mitigate CVE-2025-66374

Immediate Actions Required

• Identify all systems running CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and earlier
• Apply the security patch by upgrading to CyberArk EPM Agent version 25.12 or later immediately
• Review EPM policies to ensure proper restrictions on Administration task elevation
• Audit recent privilege elevation events on affected systems for signs of exploitation

Patch Information

CyberArk has addressed this vulnerability in EPM Agent version 25.12. Organizations should upgrade to this version or later as soon as possible. Detailed patch information is available in the CyberArk Release Notes Update and the CyberArk CA26-01 Advisory.

For additional security guidance, refer to the CyberArk Product Security Overview.

Workarounds

• Implement strict least-privilege access controls on endpoints running vulnerable EPM Agent versions
• Monitor and restrict local user accounts that have access to systems with EPM Agent installed
• Enable enhanced auditing for all privilege elevation activities until patching is complete
• Consider network isolation for high-value assets running vulnerable agent versions as a temporary measure

# Verify current EPM Agent version on Windows
# Run in elevated PowerShell to check installed version
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*CyberArk*Endpoint*" } | Select-Object Name, Version

# Review Windows Security logs for privilege escalation attempts
Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4672)]]" -MaxEvents 100 | Format-Table TimeCreated, Message -AutoSize