BeyondTrust EPM CVE-2026-40145

Exploitation requires a local session with high-privilege credentials on a Windows endpoint running BeyondTrust EPM prior to 26.1.2 (PR:H per CVSS 4.0 vector). Additionally, AT:P indicates that specific attack prerequisites must be present - the interaction between the support utility and tamper protection must occur under conditions that are not universally present across all EPM deployments. The precise triggering configuration is not publicly disclosed in available sources. What limits exploitation: the attacker must already hold local high-privilege access, must be operating in a specific EPM deployment state, and must be able to invoke the support utility - eliminating remote, unauthenticated, and standard-user attack paths entirely. The 'Information Disclosure' tag in the CVE metadata suggests data exposure is one impact pathway alongside integrity/availability, though the CVSS vector does not differentiate these sub-impacts.

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:H/UI:N) yields a score of 7.1, reflecting a local-only attack that requires high privilege and specific prerequisite conditions (AT:P). The PR:H requirement is the most significant limiting factor: an attacker must already hold substantial control over the endpoint before exploitation is possible, meaning this is primarily a post-compromise or insider threat scenario rather than an initial access vector. The AT:P flag confirms that exploitation is not reliable against arbitrary EPM deployments - specific conditions must be present. No EPSS data was provided, no POC is known, and the CVE is absent from CISA KEV, all consistent with a low-to-moderate real-world exploitation probability. Despite the high CIA impact scores on the vulnerable system, the combination of local-only access, high privilege prerequisites, and attack-condition dependency makes this a secondary priority compared to network-facing, lower-privilege vulnerabilities. However, for defenders: disabling a privileged security agent is a classic attacker objective post-compromise, and EPM environments should treat this as a meaningful defense-in-depth concern.

A local administrator or privileged service account on a Windows endpoint running EPM prior to 26.1.2 invokes the EPM support utility under a specific condition that causes tamper protection enforcement to fail. With tamper protection bypassed, the attacker can disable, reconfigure, or extract data from the EPM agent, effectively neutralizing the endpoint's privilege management controls. No public proof-of-concept exists at the time of analysis, so exploitation currently requires independent knowledge of the triggering condition.