CVE-2026-40145
Received Received - Intake

Endpoint Privilege Management Utility Tamper Protection Bypass

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: BeyondTrust

Description
A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deployment) support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-40145
EUVD
EUVD-2026-60270

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
beyondtrust endpoint_privilege_management to 26.1.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1220 The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects BeyondTrust's Endpoint Privilege Management (Windows Deployment) support utility. It involves incorrect enforcement of tamper protection controls on the utility process under certain conditions, potentially allowing unauthorized modifications.

Impact Analysis

An attacker could exploit this to bypass security protections on the utility process, potentially gaining elevated privileges or disabling security features. This could lead to unauthorized system access or malware execution.

Compliance Impact

This vulnerability may violate compliance requirements that mandate strict access controls and tamper protection, such as GDPR's integrity principle or HIPAA's security rule. Organizations using affected versions could face non-compliance risks.

Mitigation Strategies

Update BeyondTrust Endpoint Privilege Management to version 26.1.2 or later to address the vulnerability. Disable the affected utility process if immediate patching is not possible and verify tamper protection controls are enforced correctly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40145. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart