Comment by tptacek

Yes, privilege escalation is common. If someone gets code execution on your server, assume they got everything.