Critical Flaws in BeyondTrust EPM for Windows Uncovered

BeyondTrust has identified two significant vulnerabilities in its Windows Endpoint Privilege Management (EPM) software, potentially allowing local attackers to elevate privileges and circumvent anti-tamper mechanisms. These vulnerabilities, known as CVE-2026-40144 and CVE-2026-40145, impact all versions released before 26.1.2, as detailed in the company’s advisory BT26-04 issued on August 17, 2026.

Details of the Discovered Vulnerabilities

The vulnerabilities were identified during internal security assessments using advanced AI models and proprietary testing methods. BeyondTrust has confirmed that neither flaw was exploited before they were addressed. CVE-2026-40144, the more severe of the two, is an out-of-bounds read vulnerability rated with a CVSS v4 score of 7.3. This issue, classified under CWE-125, affects a kernel-mode component of the EPM, where insufficient input validation can lead to unauthorized memory access.

Exploitation of this flaw could allow an attacker with local access and standard user privileges to execute arbitrary code in kernel mode, potentially gaining full control of the system. Such vulnerabilities are particularly concerning as they require an initial local foothold, often achieved through phishing or malware.

Implications of CVE-2026-40145

The second vulnerability, CVE-2026-40145, has a CVSS v4 score of 7.1 and involves inadequate access control between the support utility and anti-tamper features of the EPM. Under specific conditions, the protections designed for the support utility may fail, allowing an attacker with elevated privileges to execute unauthorized code.

Though it doesn’t provide an initial entry point for privilege escalation, CVE-2026-40145 can be used to undermine security controls once an attacker has already acquired elevated access. This makes it an attractive target for those looking to maintain or expand their control over a compromised system.

Recommendations and Security Measures

BeyondTrust has resolved these vulnerabilities in version 26.1.2 of the Windows EPM. Users are strongly advised to update to this version or later to mitigate potential risks. Security teams should also monitor for any unusual activity related to privilege escalation, unexpected crashes, or suspicious processes involving EPM support utilities.

The advisory underscores the critical nature of promptly updating privilege management tools, which often operate with elevated permissions and are crucial for enforcing security boundaries. Failing to patch such vulnerabilities promptly can leave systems exposed to potentially severe exploits.

In conclusion, maintaining the integrity of endpoint security systems like BeyondTrust EPM is vital for protecting organizational infrastructure. Regular updates and vigilant monitoring are essential practices to safeguard against emerging threats.