Privilege Escalation Explained: Types, Techniques & Defense

A stolen password rarely gives an attacker what they actually want. Most intrusions begin on an ordinary, low-privilege account — a mailbox, a workstation login, a service account with just enough access to be a nuisance. The move that turns that nuisance into a breach is privilege escalation: the step where an attacker trades a limited foothold for the keys to the whole system. In 2026 it remains one of the most consequential phases of an attack, because it is the difference between one compromised laptop and a domain-wide ransomware event.

Privilege escalation is a technique in which an attacker who already has some access to a system gains higher-level permissions than they were granted — moving from a standard user to an administrator, root, or domain-admin account. It exploits flaws in software, misconfigurations, or stolen credentials to bypass access controls, and it is what lets a minor compromise become full system control.

How Privilege Escalation Works

Operating systems, applications, and cloud platforms all run on a model of least privilege in principle: every user and process is supposed to hold only the permissions its role requires. A standard account cannot read another user's files, install a kernel driver, or change security settings. Privilege escalation is the art of breaking that boundary — convincing the system to run the attacker's actions in a more powerful security context than their account should allow.

It almost never happens first. Escalation is a post-initial-access activity: the attacker already holds a foothold (from phishing, a stolen credential, or an exploited vulnerability) and now needs more power to reach their objective. In MITRE ATT&CK, it is its own tactic — TA0004 — sitting between Initial Access and the later stages of an intrusion. Once elevated, an attacker can disable logging and endpoint defenses, read protected data, create persistent accounts, and use lateral movement to spread to systems the original account could never touch.

Vertical vs. Horizontal Privilege Escalation

Escalation comes in two shapes, and real attacks usually combine them. Vertical privilege escalation — also called privilege elevation — means gaining a higher tier of access than you started with: a standard user becoming a local administrator, or a local admin becoming domain admin or root. This is the more dangerous form, because each rung unlocks controls that were previously off-limits.

Horizontal privilege escalation means moving sideways to another account at the same privilege level — from one user's mailbox to a colleague's, or from one tenant to another in a shared application. It does not, by itself, grant more power, but it widens the blast radius and is often reconnaissance for a vertical jump: each account an attacker lands on yields new credentials, tokens, or clues about where the high-value targets sit. A typical campaign moves horizontally to collect material, then vertically to cash it in.

Common Privilege Escalation Techniques

Attackers have a deep toolbox for climbing the ladder. The most common techniques fall into a handful of families:

• Kernel and software exploits. A flaw in the operating-system kernel or a privileged service lets attacker-supplied code run with system-level rights. Windows CLFS driver bugs and Linux kernel flaws like Dirty Pipe (CVE-2022-0847) are recurring examples.
• Misconfigurations and weak permissions. Over-permissive file and registry access controls, writable service binaries, unquoted service paths on Windows, or a misconfigured sudo rule on Linux can hand over root without any exploit code at all.
• Credential theft. Dumping password hashes, tokens, or Kerberos tickets from memory (as with pass-the-hash and Kerberoasting) lets an attacker authenticate as a more privileged user.
• Access-token and SUID abuse. On Windows, stealing or impersonating the access token of a privileged process elevates a session. On Linux, exploiting misconfigured SUID/SGID binaries runs code as their owner — often root.
• DLL hijacking and search-order abuse. Planting a malicious library where a privileged program will load it before the legitimate one causes the attacker's code to run with that program's privileges.
• Cloud IAM privilege abuse. In cloud environments the ladder is made of identity and access management roles: over-broad policies, exposed access keys, or a role that can be assumed or modified let an attacker escalate from a single workload to control of the whole account.

Real-World Examples

Privilege escalation is not theoretical — it shows up in the highest-profile incidents of the decade:

• PwnKit (CVE-2021-4034). A memory-corruption flaw in polkit's pkexec, disclosed by Qualys in January 2022, let any local user gain full root on virtually every major Linux distribution. Because pkexec ships by default, it became one of the most widely weaponized local-root bugs in years.
• Windows CLFS zero-day (CVE-2025-32701). In April 2025 Microsoft confirmed a Common Log File System driver flaw was being exploited in the wild to elevate to SYSTEM as part of ransomware operations — a textbook example of escalation as the pivot between a foothold and a full encryption event.
• Capital One (2019). A server-side request forgery let an attacker reach the metadata service of a cloud instance and steal the IAM role's temporary credentials, then use that role's over-broad permissions to read more than 100 million customer records from storage buckets — cloud IAM privilege abuse at scale.

Where It Sits in the Attack Chain

Privilege escalation is a middle-of-the-game move. On the cyber kill chain, it happens after an attacker has delivered and executed their initial access and needs to expand control before acting on objectives. It is tightly coupled with lateral movement: escalation gives an attacker the credentials or rights to reach the next machine, and each new machine offers fresh chances to escalate again. Break either link and you stall the whole intrusion — which is why detecting an unexpected jump in privilege is one of the most valuable alarms a security team can build.

How to Prevent Privilege Escalation

No single control stops escalation; defense is about removing rungs from the ladder and watching the ones that remain:

• Enforce least privilege. Give every account and workload the minimum permissions it needs, remove standing local-admin rights, and separate everyday accounts from administrative ones. A zero trust model that re-verifies access continuously shrinks what a single stolen identity can reach.
• Patch aggressively. Escalation exploits target known kernel and driver vulnerabilities; prioritize patching anything on the CISA Known Exploited Vulnerabilities catalog, especially local-privilege-escalation bugs.
• Deploy privileged access management (PAM). Vault admin credentials, issue them just-in-time, require approval and session recording, and rotate them automatically so a stolen secret has a short shelf life.
• Run EDR and monitor for the signals. Endpoint detection and response tools flag token manipulation, suspicious child processes, and known escalation techniques; alert on new admin-group membership, unusual sudo use, and cloud IAM policy changes.
• Harden systems. Audit SUID binaries and sudo rules, fix weak file and service permissions, enable UAC and Credential Guard on Windows, and tighten cloud IAM roles to eliminate the misconfigurations that make escalation trivial.

Frequently Asked Questions

What is privilege escalation in cybersecurity?

It is the act of gaining higher permissions on a system than you were granted — moving from a standard user to administrator, root, or domain admin — by exploiting a vulnerability, a misconfiguration, or stolen credentials. It turns a limited foothold into broader or total system control.

What are the two types of privilege escalation?

Vertical escalation, where an attacker gains a higher level of access (user to admin or root), and horizontal escalation, where they move sideways to another account at the same level to widen access. Attacks commonly use horizontal moves to gather credentials, then a vertical jump to seize control.

Why is privilege escalation dangerous?

Because it removes the guardrails. With administrator or root access an attacker can disable security tools, read and destroy protected data, deploy ransomware, and create persistent backdoors — often before anyone notices, since elevated actions blend in with legitimate admin activity.

Further Reading

• MITRE ATT&CK — Privilege Escalation (TA0004)
• CISA — Known Exploited Vulnerabilities Catalog
• Microsoft Security — Exploitation of CLFS zero-day leads to ransomware activity
• Qualys — PwnKit: Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)
• NIST SP 800-53 — Access Control (AC) family