CVE-2025-0889 Privilege Management for Windows – Elevation of Privilege
A local attacker can elevate privileges by manipulating COM objects when specific EPM policies allow automatic elevation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0889?
CVE-2025-0889 is a high-severity vulnerability in BeyondTrust Privilege Management for Windows, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows installed, via the manipulation of COM objects under certain circumstances where an EPM policy allows for automatic privilege elevation of a user process.
Weakness: CWE-268
Which versions are affected by CVE-2025-0889?
It affects 1 product.
Products include Beyondtrust Privilege Management for Windows.
How do I fix CVE-2025-0889?
No fix has been published for CVE-2025-0889 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-0889 being exploited?
There is no known exploitation of CVE-2025-0889 in the wild and no public exploit code.
Other vulnerabilities in BeyondTrust Privilege Management for Windows
Sources
Also known as GHSA-3w65-g885-345g.