Beyondtrust vulnerabilities
40 vulnerabilities
Known vulnerabilities in Beyondtrust products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 23 products.
Products
23- Privilege Management For Windows13 vulnerabilities
- Privileged Remote Access11 vulnerabilities
- Remote Support11 vulnerabilities
- Remote Support(Rs) & Privileged Remote Access(Pra)3 vulnerabilities
- Beyondinsight2 vulnerabilities
- Beyondinsight Password Safe2 vulnerabilities
- Beyondinsight Passwordsafe2 vulnerabilities
- Privilege Management For Mac2 vulnerabilities
- U Series Appliance2 vulnerabilities
- Appliance Base Software1 vulnerabilities
- Avecto Defendpoint1 vulnerabilities
- Endpoint Privilege Management (Windows Deployment)1 vulnerabilities
- Endpoint Privilege Management (Windows Deployments)1 vulnerabilities
- Privilege Management For Unix\/Linux1 vulnerabilities
- Privilege Management For Windows And Mac1 vulnerabilities
- Privilege Remote Access1 vulnerabilities
- Privileged Identity1 vulnerabilities
- Privileged Remote Access (Pra)1 vulnerabilities
- Remote Support & Privileged Remote Access1 vulnerabilities
- Remote Support (RS)1 vulnerabilities
- Privileged Remote Access (PRA) and Remote Support (RS)0 vulnerabilities
- Remote Support (RS) and Privileged Remote Access (PRA)0 vulnerabilities
- Remote Support (RS), Privileged Remote Access (PRA)0 vulnerabilities
CVE-2026-102764beyondtrustremote_supportKEV
EPSS score1.18%
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.CVE-2018-10959beyondtrustavecto_defendpointEPSS score1.60%
Avecto Defendpoint 4 prior to 4.4 SR6 and 5 prior to 5.1 SR1 has an Untrusted Search Path vulnerability, exploitable by modifying environment variables to trigger automatic elevation of an attacker's process launch.CVE-2021-42254beyondtrustprivilege_management_for_windowsEPSS score0.30%
BeyondTrust Privilege Management prior to version 21.6 creates a Temporary File in a Directory with Insecure Permissions.CVE-2021-31589beyondtrustappliance_base_softwareEPSS score25.99%
A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 and older, which allows the injection of unauthenticated, specially-crafted web requests without proper sanitization.CVE-2021-3187beyondtrustprivilege_management_for_macEPSS score0.64%
An issue was discovered in BeyondTrust Privilege Management for Mac before 5.7. An authenticated, unprivileged user can elevate privileges by running a malicious script (that executes as root from a temporary directory) during install time. (This applies to macOS before 10.15.5, or Security Update 2020-003 on Mojave and High Sierra, Later versions of macOS are not vulnerable.)CVE-2021-3156alpinesudo+66KEVEPSS score99.96%
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.CVE-2025-2297beyondtrustprivilege_management_for_windowsEPSS score0.13%
Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.CVE-2025-0217beyondtrustprivileged_remote_accessEPSS score0.19%
BeyondTrust Privileged Remote Access (PRA) versions prior to 25.1 are vulnerable to a local authentication bypass. A local authenticated attacker can view the connection details of a ShellJump session that was initiated with external tools, allowing unauthorized access to connected sessions.CVE-2025-0889beyondtrustprivilege_management_for_windowsEPSS score0.20%
Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows installed, via the manipulation of COM objects under certain circumstances where an EPM policy allows for automatic privilege elevation of a user process.CVE-2025-5309beyondtrustprivileged_remote_access+3EPSS score0.95%
The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution.CVE-2025-6250beyondtrustprivilege_management_for_windowsEPSS score0.17%
Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions.CVE-2020-9326beyondtrustprivilege_management_for_windows_and_macEPSS score1.04%
BeyondTrust Privilege Management for Windows and Mac (aka PMWM; formerly Avecto Defendpoint) 5.1 through 5.5 before 5.5 SR1 mishandles command-line arguments with PowerShell .ps1 file extensions present, leading to a DefendpointService.exe crash.CVE-2020-28369beyondtrustprivilege_management_for_windowsEPSS score0.23%
In BeyondTrust Privilege Management for Windows (aka PMfW) through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location %WINDIR%\Temp.CVE-2020-12612beyondtrustprivilege_management_for_windowsEPSS score0.26%
An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. When specifying a program to elevate, it can typically be found within the Program Files (x86) folder and therefore uses the %ProgramFiles(x86)% environment variable. However, when this same policy gets pushed to a 32bit machine, this environment variable does not exist. Therefore, since the standard user can create a user level environment variable, they can repoint this variable to any folder the user has full control of. Then, the folder structure can be created in such a way that a rule matches and arbitrary code runs elevated.CVE-2020-12615beyondtrustprivilege_management_for_windowsEPSS score0.22%
An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. When adding the Add Admin token to a process, and specifying that it runs at medium integrity with the user owning the process, this security token can be stolen and applied to arbitrary processes.CVE-2020-12614beyondtrustprivilege_management_for_windowsEPSS score0.14%
An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. If the publisher criteria is selected, it defines the name of a publisher that must be present in the certificate (and also requires that the certificate is valid). If an Add Admin token is protected by this criteria, it can be leveraged by a malicious actor to achieve Elevation of Privileges from standard user to administrator.CVE-2020-12613beyondtrustprivilege_management_for_windowsEPSS score0.77%
An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. An attacker can spawn a process with multiple users as part of the security token (prior to Avecto elevation). When Avecto elevates the process, it removes the user who is launching the process, but not the second user. Therefore this second user still retains access and can give permission to the process back to the first user.CVE-2017-5996beyondtrustremote_supportEPSS score1.30%
The agent in Bomgar Remote Support 15.2.x before 15.2.3, 16.1.x before 16.1.5, and 16.2.x before 16.2.4 allows DLL hijacking because of weak %SYSTEMDRIVE%\ProgramData permissions.CVE-2024-1591beyondtrustprivilege_management_for_windowsEPSS score0.16%
Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them to view the policy and potentially find configuration issues.CVE-2024-9110beyondtrustprivileged_identityEPSS score0.24%
A medium severity vulnerability has been identified within Privileged Identity which can allow an attacker to perform reflected cross-site scripting attacks.