[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is Privilege Escalation?](/blog/privilege-escalation) Publish date July 4, 2025 {x} minute read # What is Privilege Escalation? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) Privilege escalation is the [exploitation](https://www.upguard.com/blog/exploit) of a programming error, [vulnerability](https://www.upguard.com/blog/vulnerability), design flaw, configuration oversight or [access control](https://www.upguard.com/blog/access-control) in an operating system or application to gain unauthorized access to resources that are usually restricted from the application or user. This results in the application or user having more privileges than intended by the developer or system administrator, allowing attackers to gain access to [sensitive data](https://www.upguard.com/blog/sensitive-data), install [malware](https://www.upguard.com/blog/malware) and launch other [cyber attacks](https://www.upguard.com/blog/cyber-attack).  ## How Does Privilege Escalation Work? Most computer systems are designed for use with multiple user accounts, each of which has abilities known as privileges. Common privileges include the ability to view, edit or modify files.  Privilege escalation means an attacker gains access to privileges they are not entitled to by exploiting a privilege escalation [vulnerability](/blog/vulnerability) in a target system or application, which lets them override the limitations of the current user account.  Privilege escalation is a common way for malicious users to gain initial access to a system. Attackers start by finding a weak point in an organization's [cybersecurity](https://www.upguard.com/blog/cyber-security) to gain initial penetration to a system. In many cases, the first point of penetration will not give attackers the level of access or access to the file system they need. They will then attempt privilege escalation to gain more permissions or to obtain access to additional, more sensitive systems. In some situations, attackers attempting privilege escalation find the doors are wide open. Inadequate [information security](https://www.upguard.com/blog/information-security), failure to follow the [principle of least privilege](https://www.upguard.com/blog/principle-of-least-privilege) and a lack of [defense in depth](https://www.upguard.com/blog/defense-in-depth) leaves regular users with more privileges than they need.  In other cases, attackers exploit poor patching cadence, [zero-day vulnerabilities](https://www.upguard.com/blog/zero-day) or use specific techniques to overcome an operating system's permissions mechanism. ## Why is it Important to Prevent Privilege Escalation? While privilege escalation is generally not the end goal of an attacker, it is frequently used in preparation for a more specific cyber attack, allowing intruders to deploy a malicious payload, adjust security settings and open up additional attack vectors in the targeted system.  Whenever you detect or suspect privilege escalation, use [digital forensics](https://www.upguard.com/blog/digital-forensics) to find signs of other malicious activities like [computer worms](https://www.upguard.com/blog/computer-worm), [malware](https://www.upguard.com/blog/malware), [corporate espionage](https://www.upguard.com/blog/corporate-espionage), [data breaches](https://www.upguard.com/blog/data-breach), [data leaks](https://www.upguard.com/blog/data-leak), [man-in-the-middle attacks](https://www.upguard.com/blog/man-in-the-middle-attack) and stolen [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii), [protected health information (PHI)](https://www.upguard.com/blog/protected-health-information-phi), [psychographic data](https://www.upguard.com/blog/psychographic-data) or [biometrics](https://www.upguard.com/blog/biometrics). Even without evidence of further attacks, privilege escalation incidents represent significant [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk) because it means someone has gained unauthorized access to a privileged account and confidential or sensitive information. In many industries, these incidents need to be reported internally and to relevant authorities to ensure regulatory compliance.  ## What are the Two Types of Privilege Escalation? There are two main privilege escalation techniques: 1. **Vertical privilege escalation (privilege elevation):** An attacker attempts to gain higher privileges or access with an existing account they have compromised. For example, an attacker takes over a regular user account on a network and attempts to gain administrative privileges. Typically the administrator or system user on Microsoft Windows, or root on Unix and Linux systems. Once they gain elevated privileges, attackers can steal [sensitive data](/blog/sensitive-data) about a specific user, install [ransomware](https://www.upguard.com/blog/ransomware), [spyware](https://www.upguard.com/blog/spyware) or other [types of malware](https://www.upguard.com/blog/types-of-malware), execute malicious code and damage the [security posture](/blog/security-posture) of your organization.  2. **Horizontal privilege escalation:** An attacker expands their privileges by taking over a privileged account and misusing the legitimate privileges granted to the user. For local privilege escalation attacks this might mean hijacking an account with administrator privileges or root privileges, for web applications might mean gaining access to a user's bank account or the admin account of a SaaS app. ## What are Examples of Privilege Escalation? Three common privilege escalation techniques are: 1. **Access token manipulation: **Takes advantage of the way Microsoft Windows manages administrator privileges. Normally, Windows uses access tokens to determine the owners of running processes. With token manipulation, the attacker fools the system into believing the running processes belong to a different user than the one that actually started the process. When this happens, the process takes on the security context associated with the attacker's access token. This is a form of privilege elevation or vertical privilege escalation.  2. **Bypassing user account control: **Windows has a structured mechanism for controlling user privileges called user account control (UAC) that serves as a barrier between normal users and administrators, limiting standard user permissions until an administrator authorizes increased privileges. However, if the UAC protection level on a computer is not properly configured, some Windows programs will be allowed to elevate privileges or execute Component Object Model (COM) objects without asking for administrator permission first. For example, the rundll32.exe can load a Dynamic Link Library (DLL) which loads a COM object that has elevated privileges, allowing attackers to bypass UAC and gain access to protected directories.  3. **Using valid accounts: **Attackers gain unauthorized access to an administrator or user with elevated privileges and use it to log in to a sensitive system or create their own logon credentials.  ## How to Prevent Privilege Escalation Attacks Attackers use many privilege escalation techniques to achieve their goals. The good news is if you can quickly detect successful or attempted privilege escalations attacks, you have a good chance of stopping intruders before they can launch their main attack. To attempt privilege escalation in the first place, attackers usually need to gain access to a less privileged account. This means that regular user accounts are your first line of defense, make sure to invest in strong [access control](https://www.upguard.com/blog/access-control): * **Enforce password policies:** One of the simplest ways to improve security is to enforce secure passwords. Don't reuse passwords, as they may be exposed in [big data breaches](https://www.upguard.com/blog/biggest-data-breaches).  [See our guide on how to create strong passwords](https://www.upguard.com/blog/the-password-security-checklist) and invest in a tool to [continuously monitor for leaked credentials](https://www.upguard.com/product/breach-risk/threat-monitoring).  * **Create specialized users and groups with minimum necessary privileges and file access:**[The principle of least privilege](https://www.upguard.com/blog/principle-of-least-privilege) in a security context refers to providing normal users with only the set of privileges they need to do their job and nothing more. [Read our guide on access control for more information](https://www.upguard.com/blog/access-control). While it's convenient to give every user the same level of access to all resources, it provides attackers with a single point of entry into your organization, it's far safer to employ [defense in depth](/blog/defense-in-depth) across your [data security](https://www.upguard.com/blog/data-security), [information security](https://www.upguard.com/blog/information-security) and [network security](https://www.upguard.com/blog/network-security) efforts. * **Invest in cybersecurity awareness training: **Even if your organization has a robust, enforced password policy [social engineering attacks](/blog/social-engineering) like [phishing](/blog/phishing) and [spear phishing](/blog/spear-phishing) can lead to cybercriminals gaining access to your sensitive systems. Educate your employees and [third-party vendors](/blog/third-party-vendor) on common [cyber threats](https://www.upguard.com/blog/third-party-vendor) and how to avoid them. Enable [DMARC](https://www.upguard.com/blog/dmarc) to prevent [email spoofing](https://www.upguard.com/blog/email-spoofing) and buy potential [typosquatting](https://www.upguard.com/blog/typosquatting) domains.  For application security, it's vital to: * **Avoid common programming errors in applications:** Follow best practices to avoid common bugs that are targeted by attackers, e.g. buffer overflows, code injections and unvalidated user input. [Read our guide on server hardening](https://www.upguard.com/blog/the-windows-server-hardening-checklist) and invest in a tool to monitor for [unintended data exposures](https://www.upguard.com/product/breach-risk).  * **Secure databases and sanitize user input: **Databases are attractive targets as many web applications store [sensitive data](https://www.upguard.com/blog/sensitive-data) in databases including login credentials, user data and payment methods. One SQL injection can give attackers access to all this information and allow them to launch additional [cyber attacks](https://www.upguard.com/blog/cyber-attack). Poor [configuration management](https://www.upguard.com/blog/5-configuration-management-boss) can lead to [data leaks](https://www.upguard.com/blog/data-leak) which is why it's important to [encrypt](https://www.upguard.com/blog/encryption) data at rest and in transit.  Not all privilege escalation relies on user accounts, administrator privileges can be obtained be exploiting vulnerabilities in applications operating systems and [configuration management](https://www.upguard.com/blog/5-configuration-management-boss), minimize your [attack surface](/blog/attack-surface) by:  * **Keeping systems and applications updated:** Many attacks [exploit](https://www.upguard.com/blog/exploit) known [vulnerabilities](https://www.upguard.com/blog/vulnerability) listed on [CVE](https://www.upguard.com/blog/cve). By keeping a consistent patching cadence you are minimizing this [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk). * **Ensuring correct permissions for files, directories and web servers:** Follow [the principle of least privilege](https://www.upguard.com/blog/principle-of-least-privilege), check [S3 security settings](https://www.upguard.com/blog/s3-security-is-flawed-by-design) and ensure that only those who need access have access.  * **Closing unnecessary ports and removing unused accounts: **Default system configurations often include unnecessary services and arbitrary code running on open ports, each one is a potential [attack vector](https://www.upguard.com/blog/attack-vector). Remove default and unused accounts to avoid attackers and former employees gaining access to sensitive systems. * **Avoiding default login credentials: **This might seem obvious but many organizations fail to change the default login credentials on their devices such as printers, routers and IoT devices. No matter how secure your [network security](https://www.upguard.com/blog/network-security) is, one router is using the default admin/password login credentials could be enough for an attacker to intrude.  * **Removing or restricting file transfer functionality:** FTP, TFPT, wget, curl and other file transfer functions are a common way to download and execute malicious code or malicious writable. Consider removing these tools or restricting their use to specific directories, users and applications.  And remember [information risk management](https://www.upguard.com/blog/information-risk-management) and your [information security policy](https://www.upguard.com/blog/information-security-policy) can't stop with your organization: * **Monitor your third and fourth-party vendors: **Attackers can use your vendors to gain access to your organization. This is why [vendor risk management](https://www.upguard.com/blog/vendor-risk-management) is a fundamental part of preventing privilege escalation attacks. Remember that vendor risk management is a regulatory requirement for [FISMA](https://www.upguard.com/blog/fisma), [GLBA](https://www.upguard.com/blog/glba), [PIPEDA](https://www.upguard.com/blog/pipeda) and the [NIST Cybersecurity Framework](https://www.upguard.com/blog/nist-cybersecurity-framework).  * **Avoid vendors with poor cybersecurity: **Ask for your vendor's [SOC 2](/blog/soc-2) report and [information security policy](/blog/information-security-policy). * **Modernize your vendor risk management: **Develop a [risk assessment methodology](https://www.upguard.com/blog/risk-assessment-methodology), [third-party risk management framework](https://www.upguard.com/blog/third-party-risk-management-framework) and [vendor management policy](https://www.upguard.com/blog/vendor-management-policy). Consider using an established [vendor risk assessment questionnaire template](https://www.upguard.com/blog/vendor-risk-assessment-questionnaire-template) that you use to understand your vendors' security posture.  * [**Automate vendor risk management**](https://www.upguard.com/blog/automate-vendor-risk-management)**: **Invest in a tool that can [rate your vendors' security posture against 50+ criteria](https://www.upguard.com/product/vendorrisk) and assign them a [security rating](https://www.upguard.com/blog/what-are-security-ratings).  This can greatly reduce your [third-party risk](/blog/five-things-to-know-about-third-party-risk) and [fourth-party risk](/blog/what-is-fourth-party-risk). eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)