CVE-2025-59230

What it actually does

This is a local privilege-escalation flaw caused by improper access control in Windows Remote Access Connection Manager. An authenticated attacker who already has local code execution or an interactive foothold on a Windows system can abuse the vulnerable component to cross a privilege boundary and execute actions with higher privileges, potentially including administrative or SYSTEM-level execution. It is not a standalone remote, unauthenticated compromise path; the attacker must first be authorized on the target system.

Why it matters to the business

Successful exploitation can turn a limited Windows foothold into full host control, enabling credential theft, security-tool tampering, persistence, lateral movement, and broader compromise of Windows estates. Because this vulnerability is listed in CISA KEV and marked as actively exploited in the wild, remediation should be treated as urgent even though the EPSS score is relatively low. Organizations subject to CISA KEV timelines should remediate by 2025-11-04 or follow an equivalent emergency patch cadence.

How an attack unfolds

An attacker first obtains access to a Windows endpoint or server as a standard user through phishing, stolen credentials, malware, remote access misuse, or another initial-access technique. From that foothold, the attacker runs exploit code locally that targets improper access controls in the Remote Access Connection Manager service or its privileged operations. The exploit causes a privileged Windows component to perform an action the low-privileged user should not be allowed to perform, resulting in elevated execution. Once elevated, the attacker can launch a high-integrity shell or service, dump credentials, disable endpoint protections, create persistence, and move laterally. Public reporting indicates active exploitation, but the provided context does not identify a named threat actor beyond Microsoft Patch Tuesday/advisory context.

How to fix it

Apply the Microsoft security updates that address this vulnerability for all affected Windows versions, prioritizing internet-facing systems, user workstations, jump hosts, remote-access infrastructure, and servers where standard users can log on. Because no exact fixed build numbers were provided in the input, use the Microsoft Security Update Guide and the October 2025 cumulative updates or later applicable updates for each supported Windows release. Where immediate patching is not possible, reduce exposure by limiting interactive logon rights, removing unnecessary local users, enforcing least privilege, restricting RDP/VPN access, monitoring and controlling local administrator group membership, and using endpoint controls to block untrusted local exploit execution. Do not rely on disabling Remote Access Connection Manager unless Microsoft or product owners confirm it is safe for the workload, because the service may be required for VPN, dial-up, or network connectivity features.

How to confirm the fix worked

Confirm that each Windows asset has installed the Microsoft update that supersedes or remediates this issue by checking Windows Update history, enterprise patch-management inventory, vulnerability scanner results, and Microsoft Security Update Guide applicability. Validate that systems report a non-vulnerable state after patching and that no pending reboot remains. On representative systems, verify the Remote Access Connection Manager component files and OS build match the patched Microsoft baseline for the installed Windows version. Confirm compensating controls are in place on systems awaiting patches, including restricted interactive logon, controlled local admin membership, and EDR coverage.

Typical attack path

1. Gain authenticated access to a Windows system as a low-privileged user.
2. Stage or execute a local exploit targeting Windows Remote Access Connection Manager access controls.
3. Trigger the vulnerable privileged operation to obtain elevated privileges.
4. Spawn an elevated process, service, scheduled task, or command shell.
5. Use elevated access to disable defenses, access credentials, establish persistence, or move laterally.

How to detect it

Look for post-exploitation behavior rather than a single reliable exploit signature. Relevant log sources include Windows Security logs, System logs, Microsoft-Windows-RasMan/Operational if enabled, Service Control Manager events, PowerShell logs, Sysmon/EDR telemetry, and patch-management data. Hunt for low-privileged users who authenticate locally or over RDP and shortly afterward create elevated processes, start or restart Remote Access Connection Manager unexpectedly, create services or scheduled tasks, receive special privileges, modify local administrators, or access credential stores. Useful Windows events include 4624 for logon, 4672 for special privileges assigned, 4688 for process creation, 4697 for service installation, 4698 for scheduled task creation, 4720/4728/4732 for account or group changes, 7040/7045 in System logs for service configuration and installation, and PowerShell 4103/4104 for suspicious script execution. Investigate sequences where user-writable paths launch binaries that quickly result in elevated cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, schtasks.exe, sc.exe, net.exe, or credential-access tooling. Since this is a local privilege-escalation vulnerability, exploitation is likely to appear as a transition from standard-user activity to administrative or SYSTEM-level activity on the same host.

• RasMan
• Remote Access Connection Manager
• Microsoft-Windows-RasMan/Operational
• svchost.exe -k netsvcs -p -s RasMan
• Event ID 4672
• Event ID 4688
• Event ID 4697
• Event ID 4698
• Event ID 7040
• Event ID 7045
• sc.exe create
• sc.exe config
• schtasks.exe /Create
• net localgroup administrators
• powershell.exe -ExecutionPolicy Bypass
• cmd.exe /c whoami /priv
• C:\Windows\System32\rasmans.dll
• HKLM\SYSTEM\CurrentControlSet\Services\RasMan

What your security team should do

• Treat this as a high-priority Windows privilege-escalation issue because it is in CISA KEV and has active in-the-wild exploitation.
• Patch all applicable Windows endpoints and servers using the relevant Microsoft cumulative/security updates, prioritizing systems with user logon, remote access, administrative tooling, or high-value credentials.
• Meet or beat the KEV remediation deadline of 2025-11-04 for regulated or federal-aligned environments.
• Hunt for signs of local privilege escalation followed by credential theft, service creation, defense evasion, or new administrative access.
• Review local administrators, privileged groups, scheduled tasks, and newly created services on systems where low-privileged users recently authenticated.
• Ensure EDR/Sysmon process creation and Windows Security auditing are enabled for privilege escalation, service creation, and suspicious child processes.
• Limit standard-user ability to execute untrusted binaries from user-writable directories such as Downloads, Temp, and AppData.
• If compromise is suspected, rotate credentials used on affected hosts after containment, especially local administrator, service account, and cached domain credentials.