PatchTheCVECVE-2025-2297: Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitim
CVE-2025-2297 is a high-severity flaw (CVSS 7.8) affecting privilege management for windows. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 97%) |
| CISA exploited list | No |
| Weakness | CWE-268 |
| Published | 2025-07-28 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-2297?
privilege management for windows: upgrade to 25.4.270. Exact commands for each OS are on this page.
Is CVE-2025-2297 being exploited?
CVE-2025-2297 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-2297 affect?
CVE-2025-2297 affects privilege management for windows. Severity is high (CVSS 7.8). Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit the
How urgent is CVE-2025-2297?
Priority 28/100. High severity
Software pages
Related CVEs
- CVE-2025-6250 MEDIUM 6.7 UPGRADE Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint servi
- CVE-2025-0889 HIGH 7.8 UPGRADE Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for
- CVE-2024-25083 MEDIUM 6.3 UPGRADE An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1
- CVE-2024-1591 LOW 3.3 UPGRADE Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is