Privilege Escalation
Gaining higher access than originally granted, by exploiting misconfigurations, vulnerabilities, or over-permissioned identities. Tightly linked to privileged access risk.
Most real escalations are not exploits, they are configuration: a group that grants more than anyone realized, a role that can modify its own policy, a certificate template with dangerous permissions, or a service account with domain rights. That is why attack-path analysis across the identity graph finds more than vulnerability scanning does, and why the fix is usually a permission change rather than a patch.
See also: lateral movement, least privilege, what is PAM, identity CVE catalog
Related on Start with Identity
- GlossaryStanding Privilege
Standing privilege is elevated access (an admin role, a privileged group membership, a cloud owner permission) that an account holds permanently, whether or not
- GlossaryMicrosegmentation
Microsegmentation is a network control that divides an environment into small zones and allows only the connections policy explicitly permits between them, so a
- GlossaryPrivileged Access Workstation (PAW)
A privileged access workstation (PAW) is a dedicated, hardened computer used only for administrative work, with no email, no general web browsing and only appro
- Blog1Password buys Apono, moving from credential vault to access control plane
Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, a
- CVEBeyondTrust PRA and Remote Support unauthenticated command injection
Privileged Remote Access and Remote Support accepted a malicious client request and ran OS commands as the site user. Unauthenticated. CVSS 9.8. CISA KEV. A PAM
- CVEBeyondTrust Remote Support pre-auth command injection, a variant of CVE-2024-12356
An unauthenticated request could run operating system commands on self-hosted BeyondTrust Remote Support and older Privileged Remote Access appliances. Scanning