Privilege escalation is how an attacker turns limited access into powerful access, becoming an administrator or reaching resources they should not. Vertical escalation gains higher privileges; horizontal escalation moves sideways into other users' accounts at the same level. It usually exploits misconfigurations, unpatched flaws, or excessive permissions. The defenses are least privilege, patching and hardening, removing excess permissions, and monitoring for privilege changes.
Vertical vs horizontal privilege escalation
There are two directions:
- Vertical (privilege elevation): a low-privilege user gains higher rights, a standard account becoming an administrator or root. This is the classic "become admin" move.
- Horizontal: an attacker stays at the same privilege level but accesses another user's data or account, for example viewing another customer's records by changing an ID in a request. In web applications this overlaps with IDOR and broken object-level authorisation (BOLA).
Both end with the attacker holding access they were never granted.
How attackers escalate
Escalation almost always abuses something already there:
- Misconfigurations: over-permissive sudo rules, weak file or service permissions, writable paths, exposed service accounts.
- Unpatched flaws: kernel or software vulnerabilities that hand out higher privileges.
- Excessive permissions: cloud IAM roles with far more than they need, so one compromised identity unlocks the account.
- Stolen tokens and credentials cached on a compromised host.
- Abuse of legitimate admin features that were never locked down.
In the cloud in particular, privilege escalation is usually an IAM problem: a role that can assume another role, or edit its own permissions.
Why it is the pivot of a breach
Almost no attack lands directly on the crown jewels. The chain is: get a foothold (often phishing or a stolen credential), escalate privileges, then move laterally to the data. Escalation is the hinge that turns a minor compromise into a major one.
This is exactly what a penetration test is built to find. The question is not whether one account is locked down, but whether an attacker who compromises a low-privilege user can climb to administrator and reach what matters.
How to prevent privilege escalation
Shrink both the opportunities and the payoff:
- Enforce least privilege everywhere, and review permissions regularly so they do not accumulate.
- Patch and harden operating systems, software, and cloud services promptly.
- Trim cloud IAM: remove unused permissions, avoid wildcard policies, and watch for roles that can escalate themselves.
- Separate admin accounts from everyday ones, and protect them with phishing-resistant multi-factor authentication.
- Monitor for privilege changes and new admin grants so escalation is visible.
A penetration test validates all of this by actually attempting the climb.
References
- [1]Privilege Escalation (Tactic TA0004)(MITRE ATT&CK)
- [2]Cyber Threats and Advisories(CISA)
- [3]Computer Security Resource Center Glossary(NIST)
Privilege escalation is where a small mistake becomes a big one. Keep privileges least, patched, and watched, and the attacker's climb stalls before it reaches anything worth taking.