T1548Privilege Escalation
Abuse Elevation Control Mechanism
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform…
CVEs29
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.27
Reports1
Detections
24 Sigma rules tagged T1548Abuse Elevation Control MechanismT154824 general rules
- Abused Debug Privilege by Arbitrary Parent Processeshightest
- COM Hijack via Sdclthightest
- Credential Dumping Attempt Via Svchosthightest
- Potential Privilege Escalation via Local Kerberos Relay over LDAPhightest
- Regedit as Trusted Installerhightest
- Vulnerable Netlogon Secure Channel Connection Allowedhightest
- Registry Hive File Staged Outside Standard User Profile Pathhighexperimental
- Linux Doas Conf File Creationmediumstable
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Abuse Elevation Control Mechanism
29 CVEs, by priority. Each link shows its badge.- CVE-2017-0213Microsoft Windows Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.3T1548Abuse Elevation Control MechanismT1068Exploitation for Privilege Escalation4 reportsAI mapping from the description · primary impact84.3%Top 0.3%87.0priority
- CVE-2022-1388F5 BIG-IP Missing Authentication VulnerabilityMITRE CTID mapping of the KEV entry · how it is exploited>99.9%Top 0.03%79.9priority
- CVE-2024-49039Microsoft Windows Task Scheduler Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 8.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact14.2%Top 3.4%78.5priority
- CVE-2016-7255Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft · Win32kKEVRansomwarePublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact81.0%Top 0.37%78.4priority
- CVE-2014-3153Linux Kernel Privilege Escalation VulnerabilityLinux · KernelKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact37.2%Top 1.5%78.2priority
- CVE-2023-36424Microsoft Windows Out-of-Bounds Read VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact12.1%Top 3.9%72.7priority
- CVE-2026-41091Microsoft Defender Link Following VulnerabilityMicrosoft · DefenderKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact8.2%Top 5.1%72.4priority
- CVE-2010-4398Microsoft Windows Kernel Stack-Based Buffer Overflow VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1078Valid AccountsT1068Exploitation for Privilege Escalation+1 more · 1 reportAI mapping from the description · primary impact8.7%Top 4.9%71.4priority
- CVE-2022-23131Zabbix Frontend Authentication Bypass VulnerabilityZabbix · FrontendKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+2 moreMITRE CTID mapping of the KEV entry · primary impact95.7%Top 0.13%69.8priority
- CVE-2019-13272Linux Kernel Improper Privilege Management VulnerabilityLinux · KernelKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact52.2%Top 1%68.3priority
- CVE-2025-32463Sudo Inclusion of Functionality from Untrusted Control Sphere VulnerabilitySudo · SudoKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact55.5%Top 0.97%68.3priority
- CVE-2021-3493Linux Kernel Privilege Escalation VulnerabilityLinux · KernelKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact49.2%Top 1.1%68.2priority
- CVE-2025-2783Google Chromium Mojo Sandbox Escape VulnerabilityGoogle · Chromium MojoKEVPublic exploitHigh · 8.3T1203Exploitation for Client ExecutionT1548Abuse Elevation Control Mechanism+1 moreMITRE CTID mapping of the KEV entry · primary impact9.2%Top 4.7%67.9priority
- CVE-2010-3904Linux Kernel Improper Input Validation VulnerabilityLinux · KernelKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact15.9%Top 3.1%67.8priority
- CVE-2021-38648Microsoft Open Management Infrastructure (OMI) Privilege Escalation VulnerabilityMicrosoft · Open Management Infrastructure (OMI)KEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact11.4%Top 4%67.7priority
- CVE-2025-41244Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions VulnerabilityBroadcom · VMware Aria Operations and VMware ToolsKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact8.6%Top 4.9%67.5priority
- CVE-2018-8611Microsoft Windows Kernel Privilege Escalation VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact4.2%Top 9.1%66.6priority
- CVE-2023-44221SonicWall SMA100 Appliances OS Command Injection VulnerabilitySonicWall · SMA100 AppliancesKEVHigh · 7.2T1059.004Unix ShellT1543Create or Modify System Process+2 moreMITRE CTID mapping of the KEV entry · how it is exploited76.3%Top 0.46%62.9priority
- CVE-2021-30713Apple macOS Unspecified VulnerabilityApple · macOSKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact7.0%Top 5.8%62.3priority
- CVE-2009-1123Microsoft Windows Improper Input Validation VulnerabilityMicrosoft · WindowsKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact4.9%Top 8%61.9priority
- CVE-2021-31979Microsoft Windows Kernel Privilege Escalation VulnerabilityMicrosoft · WindowsKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact4.5%Top 8.4%61.8priority
- CVE-2023-42824Apple iOS and iPadOS Kernel Privilege Escalation VulnerabilityApple · iOS and iPadOSKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact1.0%Top 38%60.8priority
- CVE-2025-59230Microsoft Windows Improper Access Control VulnerabilityMicrosoft · WindowsKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact2.7%Top 14%60.6priority
- CVE-2019-0880Microsoft Windows Privilege Escalation VulnerabilityMicrosoft · WindowsKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact2.3%Top 17%60.1priority
- CVE-2026-111357Ivanti Connect Secure Missing Authentication for Critical Function VulnerabilityIvanti · Connect SecureKEVHigh · 7.0T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact0.3%Top 75%57.0priority
- CVE-2019-8526Apple macOS Use-After-Free VulnerabilityApple · macOSKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact0.7%Top 47%54.1priority
- CVE-2025-48572Android Framework Privilege Escalation VulnerabilityAndroid · FrameworkKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismAI mapping from the description · primary impact0.3%Top 82%52.0priority
- CVE-2019-3717Select Dell Client Commercial and Consumer platforms contain an Improper Access VulnerabilityDell · Dell Client Commercial and Consumer platformsHigh · 7.1T1200Hardware AdditionsT1548Abuse Elevation Control MechanismMITRE CTID mapping of the CVE · primary impact0.4%Top 70%11.0priority
- CVE-2019-1812Cisco NX-OS CLI Command Software Image Signature Verification VulnerabilitiesCisco · Cisco NX-OS SoftwareMedium · 6.7T1078Valid AccountsT1059Command and Scripting Interpreter+1 moreMITRE CTID mapping of the CVE · follow-on activity0.3%Top 73%10.1priority
Linked through a sub-technique
4 more- CVE-2021-31207Microsoft Exchange Server Security Feature Bypass VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitMedium · 6.6T1548.002Bypass User Account ControlT1565Data Manipulation9 reports99.8%Top 0.04%87.6priority
- CVE-2023-0386Linux Kernel Improper Ownership Management VulnerabilityLinux · KernelKEVPublic exploitHigh · 7.8T1543Create or Modify System ProcessT1548.001Setuid and Setgid7.9%Top 5.3%67.4priority
- CVE-2020-3950VMware Multiple Products Privilege Escalation VulnerabilityVMware · Multiple ProductsKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548.001Setuid and Setgid7.3%Top 5.7%67.3priority
- CVE-2018-15767Improper Authorization Vulnerability12.3%Top 3.8%24.2priority