Privilege escalation occurs when a process exploits credentials, software flaws, misconfiguration, or excessive trust to gain stronger access. The escalation may be vertical, reaching administrator rights, or horizontal, reaching another identity at a similar level.
Least privilege, credential isolation, patching, access reviews, and monitoring reduce the opportunity and impact. Administrative access should be short-lived, attributable, and separated from systems that do not require it.
ELI5
Privilege escalation happens when a user, program, or AI agent gains more access than it was meant to have. It may exploit a software flaw, stolen credentials, a bad configuration, or permissions that were too broad from the start.
For example, a tool allowed only to read one folder might find a flaw that lets it become an administrator and open every file. Limited permissions, isolated credentials, timely updates, and alerts for unusual access make this harder and reduce the damage.
What can cause privilege escalation?
Common causes include exposed credentials, vulnerable software, unsafe defaults, excessive permissions, and weak separation between services.
How can privilege escalation be limited?
Use least privilege, isolate credentials, patch systems, require strong authentication, and alert on unexpected permission changes.
