Local Administrator escalation via self-signed certificate trust

Privilege escalation in BeyondTrust Privilege Management for Windows before 5.7 SR1 allows local users to gain Administrator rights. Publisher matching consults the user's certificate store, so importing a self-signed certificate bearing an allowed publisher satisfies an Add Admin rule. The affected policy must protect an Add Admin token with Publisher criteria; a standard user can then launch a matched application as an administrator.