Password Safe and Privilege Management
CVE-2025-6250: Privilege Management for Windows - Elevation of Privilege
Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Privilege Management for Windows 0 | <25.4.270 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.