A medium‑severity flaw exists in BeyondTrust Privilege Management for Windows versions 25.7 and earlier. When a local user with elevated privileges follows a specific sequence of actions, the software’s anti‑tamper checks can be bypassed. The vulnerability originates from a lack of proper validation of configuration changes (CWE‑693) and permits the attacker to interact with protected components and alter product settings. This could compromise the integrity of the privilege management service and lead to broader system compromise.

The affected product is BeyondTrust Privilege Management for Windows, with affected releases up to version 25.7. Any installation of these versions on Windows hosts is vulnerable.

The CVSS score of 6.8 indicates a moderate risk, and the EPSS score of less than 1 % suggests a very low likelihood of public exploitation at present. The vulnerability is not listed in the CISA KEV catalog, so it has not yet been confirmed as a known exploited vulnerability. Nonetheless, a local privileged user—such as a system administrator or a software developer with elevated rights—can trigger the exploit, making the attack vector local. An adversary with access to the host can leverage this to modify the configuration and potentially gain unauthorized control over privileged functions.