Windows Remote Access Connection Manager Local Privilege Escalation (CVE-2025-59230)

Historical catalog analysis: CISA added this entry on October 14, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-59230 is an improper access control vulnerability (CWE-284) located within the Windows Remote Access Connection Manager. The flaw allows an attacker who already possesses authorized access to a system to elevate their privileges locally. This vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog on October 14, 2025.

Exposure and applicability

This vulnerability affects systems running Microsoft Windows that utilize the Remote Access Connection Manager. Because this is a local privilege escalation (LPE) flaw, the primary exposure path requires an attacker to first establish a foothold on the target system with authorized credentials. Once initial access is achieved, the improper access controls in the affected component could be leveraged to gain higher-level permissions.

Remediation priorities

Based on the inclusion of this flaw in the CISA catalog, vulnerability management teams should prioritize remediation for high-value assets and systems where local access is granted to multiple users or third parties. Our analysis suggests the following priority sequence:

1. Apply Vendor Mitigations: The primary corrective action is the application of official mitigations provided by Microsoft.
2. Cloud Service Alignment: For organizations utilizing cloud services, remediation should align with BOD 22-01 guidance to ensure consistent exposure reduction across hybrid environments.
3. Product Decommissioning: In scenarios where vendor mitigations are unavailable or cannot be applied due to legacy constraints, the affected product functionality should be discontinued to eliminate the attack surface.

How to validate remediation

Verification must move beyond simple version checks, as a deployed patch does not always guarantee that the vulnerability is neutralized in the active runtime environment. To verify that exposure has been reduced, defenders should:

• Confirm Mitigation Deployment: Use configuration management tools to verify that the specific vendor-supplied updates or registry changes are present across all targeted endpoints.
• Validate Access Controls: Perform authorized testing to confirm that the Remote Access Connection Manager no longer permits unauthorized privilege transitions. This involves attempting to trigger the elevation path using a low-privileged account in a controlled environment.
• Audit Local Permissions: Review the current permissions associated with the Remote Access Connection Manager to ensure they align with the principle of least privilege, reducing the likelihood of successful exploitation even if a patch fails.

Limits and open questions

There are several unknowns regarding this vulnerability. It is currently unknown whether this flaw has been utilized in ransomware campaigns. Additionally, while CISA has set a remediation deadline of November 4, 2025, for federal agencies, this date serves as a risk indicator rather than a mandatory requirement for non-federal entities. Residual risk remains if the attacker already possesses administrative credentials or if other unpatched LPE vectors exist on the same system.

Source and editorial note

CVE-2025-59230: Microsoft Windows Improper Access Control Vulnerability · Source date: October 14, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: October 17, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 30, 2026 at 01:04 UTC.

Request a Vulnerability Assessment