Privilege Escalation
Gaining higher access than originally granted, by exploiting misconfigurations, vulnerabilities, or over-permissioned identities. Tightly linked to privileged access risk.
Most real escalations are not exploits, they are configuration: a group that grants more than anyone realized, a role that can modify its own policy, a certificate template with dangerous permissions, or a service account with domain rights. That is why attack-path analysis across the identity graph finds more than vulnerability scanning does, and why the fix is usually a permission change rather than a patch.
See also: lateral movement, least privilege, what is PAM, identity CVE catalog
Related on Start with Identity
- GlossaryMicrosegmentation
Microsegmentation is a network control that divides an environment into small zones and allows only the connections policy explicitly permits between them, so a
- GlossaryZero Standing Privileges
An access model where no one holds permanent elevated rights; privileges are granted just in time and expire automatically. The strongest form of least privileg
- GlossaryPrompt Injection
Prompt injection is a vulnerability in which input to a large language model alters its behavior or output in ways its developer did not intend, for example mak
- Blog1Password buys Apono, moving from credential vault to access control plane
Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, a
- CVEBeyondTrust PRA and Remote Support unauthenticated command injection
Privileged Remote Access and Remote Support accepted a malicious client request and ran OS commands as the site user. Unauthenticated. CVSS 9.8. CISA KEV. A PAM
- BlogBeyondTrust Remote Support zero-day let ARMORY CASTLE dump the credential vault
CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. M