What is privilege escalation in cybersecurity?

Privilege escalation is when an attacker or malicious process gains permissions beyond what was originally assigned, typically by exploiting a vulnerability or misconfiguration. It is a key step in most attack chains, allowing an intruder to move from limited access to full control of a system or network.

What is the difference between vertical and horizontal privilege escalation?

Vertical escalation means gaining a higher permission level, such as a standard user becoming an administrator. Horizontal escalation means accessing resources belonging to another user at the same permission level, without gaining elevated rights.

How do you prevent privilege escalation attacks?

Key controls include enforcing least-privilege access, removing standing local admin rights from endpoints, patching known vulnerabilities promptly, and using PAM tools to issue time-limited elevated access only when needed. Monitoring for unusual permission requests with ITDR tools also helps catch escalation attempts early.

Is privilege escalation always caused by a software vulnerability?

No. Many escalation paths come from misconfigurations, such as overly permissive sudo rules, weak file permissions, or cloud IAM roles with excessive rights. Credential theft and reuse are also common causes that do not require exploiting a software bug.

What is Privilege Escalation?

Privilege Escalation is the act of gaining permissions beyond what was originally granted, by exploiting a vulnerability, misconfiguration, or design flaw in a system. It is a core technique attackers use to move from limited access to full control of a system or environment.

What it is

Privilege escalation happens when a user, process, or piece of malware obtains rights it was never supposed to have. There are two main forms.

Vertical escalation means moving up the permission hierarchy. A standard user account gains administrator or root access. This is the most dangerous form because it can give an attacker full control of a machine or domain.

Horizontal escalation means moving sideways. An attacker keeps the same permission level but accesses resources belonging to a different user or account. Accessing another user's files or sessions without becoming an admin is a common example.

Common methods include:

Exploiting unpatched software vulnerabilities (kernel exploits, SUID binaries on Linux)
Abusing misconfigured file or registry permissions
Credential theft and reuse (pass-the-hash, token impersonation)
Abusing overly permissive service accounts or API keys
Exploiting weak sudo rules or group policy misconfigurations

Why it matters

Privilege escalation is rarely the first step in an attack. It almost always follows initial access. Once an attacker escalates, they can install malware, exfiltrate data, disable security controls, or move laterally across a network. Many high-profile breaches involved an attacker who started with a low-privilege foothold and escalated to domain administrator within hours.

Defenders care about it because limiting the blast radius of any single compromised account depends on keeping privileges tightly scoped.

How tools address it

Privileged Access Management (PAM) platforms are the primary product category built to reduce privilege escalation risk. They enforce least-privilege principles by removing standing admin rights, issuing time-limited just-in-time (JIT) access, and recording privileged sessions for audit. Endpoint privilege management tools specifically remove local administrator rights from workstations, which cuts off a large class of escalation paths.

What is Privilege Escalation?

What it is

Why it matters

How tools address it

Common confusions

Privileged Access Management tools

Frequently asked questions