This vulnerability (CVE-2026-40145) concerns insufficient granularity of access control (CWE-1220) in BeyondTrust Endpoint Privilege Management for Windows deployment. The flaw exists in how a support utility interacts with the agent's tamper protection controls, resulting in scenarios where the intended protections on the utility process are not enforced correctly. The CVSS 4.0 base score is 7.1, indicating high severity, with attack vector local, low attack complexity, and partial privileges required. No official remediation or patch information is currently available.

The vulnerability could allow an attacker with local access and high privileges to bypass or weaken tamper protection controls on the support utility process. This may lead to unauthorized modification or interference with the agent's operation, potentially undermining endpoint security controls. However, exploitation requires partial user interaction and high privileges, limiting the attack surface. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor for vendor updates and apply recommended security best practices for privileged account management. No specific mitigations are provided by the vendor at this time.