CVE-2026-40145

A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deployment) support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended.

CVSS

No CVSS.

References

Link	Resource
https://nvd.nist.gov/vuln/detail/CVE-2026-40145
https://www.beyondtrust.com/trust-center/security-advisories/bt26-04

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-17 17:16

Updated : 2026-08-18 15:04

NVD link : CVE-2026-40145

Mitre link : CVE-2026-40145

CVE.ORG link : CVE-2026-40145

JSON object : View

Products Affected

No product.

CWE

CWE-1220

Insufficient Granularity of Access Control

{"id": "CVE-2026-40145", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40145", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-17T18:16:53.700643Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "13061848-ea10-403d-bd75-c83a022c2891", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "13061848-ea10-403d-bd75-c83a022c2891", "affectedData": [{"vendor": "BeyondTrust", "product": "Endpoint Privilege Management (Windows deployment)", "versions": [{"status": "affected", "version": "0", "lessThan": "26.1.2", "versionType": "cpe"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-08-17T17:16:39.787", "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40145", "source": "13061848-ea10-403d-bd75-c83a022c2891"}, {"url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-04", "source": "13061848-ea10-403d-bd75-c83a022c2891"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "13061848-ea10-403d-bd75-c83a022c2891", "description": [{"lang": "en", "value": "CWE-1220"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in the interaction between a Endpoint Privilege Management\u00a0(Windows\u00a0Deployment)\u00a0support\u00a0utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended."}], "lastModified": "2026-08-18T15:04:46.610", "sourceIdentifier": "13061848-ea10-403d-bd75-c83a022c2891"}

CVE-2026-40145

JSON object

Attach tags to CVE-2026-40145

Attach tags to `CVE-2026-40145`