Privilege escalation is when an attacker who already has some access to a system gains higher permissions than they are supposed to have, such as moving from an ordinary user account to administrator, root, or SYSTEM. It is a middle step in most intrusions, not the entry point, and it is what turns a limited foothold into full control of a machine or network. There are two kinds: vertical escalation (gaining higher privileges) and horizontal escalation (taking over another account at the same level).

Understanding what is privilege escalation matters because it is where an attack usually becomes serious. Initial access often lands an attacker as a low-privileged user, and privilege escalation is the move that lets them disable defenses, install persistence, read other users' data, and spread. MITRE ATT&CK tracks it as an entire tactic (TA0004), which reflects how central it is to real-world intrusions.

What is the difference between vertical and horizontal privilege escalation?

Vertical privilege escalation means gaining a higher privilege level than you started with, for example a standard user becoming an administrator or a process escaping to root or SYSTEM. Horizontal privilege escalation means staying at the same level but taking over a different account or its data, such as one user accessing another user's records. Vertical escalation is usually the more dangerous because administrator or root control lets an attacker do almost anything on the host.

How does privilege escalation actually happen?

Through flaws and misconfigurations in privileged components. Common paths include vulnerabilities in the operating system kernel or drivers, insecure services running as root or SYSTEM, weak file and registry permissions, stolen or reused credentials, and misconfigured cloud IAM roles. A recurring and underrated source is the security software itself: in 2026, researchers published local privilege-escalation proof-of-concepts abusing endpoint products, and separate work escalated to a root shell through GPU memory flaws, both showing that trusted, high-privilege components are prime escalation targets.

Why do prioritization tools underrate privilege escalation?

Because privilege escalation is usually local, not remotely exploitable, so it often carries a modest CVSS score and a low EPSS percentile even when a reliable public exploit exists. That is a scoring blind spot, not a safety signal. A local escalation flaw with working exploit code is exactly what an attacker reaches for after phishing a user onto a machine, so the presence of a public proof-of-concept should weigh more heavily than the base score suggests. Kernel and driver escalation bugs are the classic example of this gap between score and real risk.

Frequently asked questions

Is privilege escalation the same as initial access? No. Initial access is how the attacker first gets in; privilege escalation is how they gain higher permissions once inside. They are different stages of an attack.

What is local privilege escalation? LPE is escalating privileges on a machine you already have some access to, typically by exploiting a vulnerable driver, service, or misconfiguration to reach administrator, root, or SYSTEM.

How do I stop privilege escalation? Enforce least privilege, patch kernel and driver flaws quickly, harden service and file permissions, monitor for abuse of privileged operations, and test whether an attacker who lands as a normal user could actually escalate.

Our read

Privilege escalation is the quiet hinge of most breaches: it rarely makes headlines the way a remote zero-day does, but it is the step that converts a small foothold into total control. The defensible posture is least privilege plus verification, assuming an attacker will land as an ordinary user and then testing whether your systems actually stop them from climbing higher. Because these flaws are often local and low-scored, do not let a CVSS number decide their urgency; weight whether a working exploit exists. Emulating the escalation an attacker would attempt, against your own machines, is how you find the gap before they do.

Tactic definition per MITRE ATT&CK TA0004; exploitation weighting per CISA KEV; control mapping per NIST SP 800-53. Sources linked above.

Related: What is a zero-day? and How to prioritize vulnerabilities.