CVE-2025-66374
Privilege Escalation in CyberArk Endpoint Privilege Manager Agent
Publication date: 2026-02-03
Last updated on: 2026-02-28
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cyberark | endpoint_privilege_manager | to 25.10.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-66374 is a privilege escalation vulnerability in the CyberArk Endpoint Privilege Manager (EPM) agent for Windows, specifically affecting versions through 25.10.0.
This vulnerability allows a local user to gain elevated privileges by exploiting the policy elevation of an Administration task within the EPM agent.
Essentially, an attacker with local access can escalate their privileges beyond what is normally permitted by manipulating administrative policies.
How can this vulnerability impact me? :
This vulnerability can have a significant security impact by allowing an unauthorized local user to escalate their privileges on a system running the affected CyberArk EPM agent.
With elevated privileges, the attacker could perform administrative actions, potentially compromising system integrity, accessing sensitive data, or disrupting operations.
Such privilege escalation can lead to broader security breaches, including unauthorized access to critical resources and increased risk of further exploitation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'The vulnerability CVE-2025-66374 affects the CyberArk Endpoint Privilege Manager (EPM) agent for Windows, allowing privilege escalation through an administrative task. Detection involves verifying the version of the EPM agent installed on your systems.'}, {'type': 'paragraph', 'content': 'Specifically, the vulnerability is present in versions up to 25.10.0 and addressed in version 25.12.0 and later. Checking the installed EPM agent version can help identify if the system is vulnerable.'}, {'type': 'paragraph', 'content': "For Linux agents, the 'sudo -l' command can be used to list allowed and forbidden sudo commands, which may help in assessing privilege configurations, although this is not a direct detection method for this vulnerability."}, {'type': 'paragraph', 'content': 'No explicit commands for detecting the vulnerability on Windows or network indicators are provided in the available resources.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade the CyberArk Endpoint Privilege Manager (EPM) agent to version 25.12.0 or later, as these versions address the privilege escalation vulnerability CVE-2025-66374.
Upgrading to the latest EPM agent version also provides additional security enhancements and behavior improvements.
It is recommended to review and apply any additional security best practices and configuration changes documented by CyberArk in their release notes and community resources.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how CVE-2025-66374 impacts compliance with common standards and regulations such as GDPR or HIPAA.