CVE-2020-12612

An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. When specifying a program to elevate, it can typically be found within the Program Files (x86) folder and therefore uses the %ProgramFiles(x86)% environment variable. However, when this same policy gets pushed to a 32bit machine, this environment variable does not exist. Therefore, since the standard user can create a user level environment variable, they can repoint this variable to any folder the user has full control of. Then, the folder structure can be created in such a way that a rule matches and arbitrary code runs elevated.

• https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1Release Notes
• https://www.beyondtrust.com/trust-center/security-advisories/bt22-09Vendor Advisory
• https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1Release Notes
• https://www.beyondtrust.com/trust-center/security-advisories/bt22-09Vendor Advisory

Published

Dec 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12604Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptib…7.5
• CVE-2020-12605Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume …7.5
• CVE-2020-12606An issue was discovered in DB Soft SGLAC before 20.05.001. T…9.8
• CVE-2020-12607An issue was discovered in fastecdsa before 2.1.2. When usin…7.5
• CVE-2020-12608An issue was discovered in SolarWinds MSP PME (Patch Managem…7.8
• CVE-2020-1261An information disclosure vulnerability exists in the way Wi…5.5
• CVE-2020-12613An issue was discovered in BeyondTrust Privilege Management …8.8
• CVE-2020-12614An issue was discovered in BeyondTrust Privilege Management …7.8
• CVE-2020-12615An issue was discovered in BeyondTrust Privilege Management …7.8
• CVE-2020-12618eM Client before 7.2.33412.0 automatically imported S/MIME c…4.8
• CVE-2020-12619MailMate before 1.11 automatically imported S/MIME certifica…5.9
• CVE-2020-1262An elevation of privilege vulnerability exists when the Wind…7.8