{"id":"CVE-2025-59230","kind":"vulnerability","aliases":["CVE-2025-59230"],"related":[],"title":"Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate…","description":"Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Windows Remote Access Connection Manager has an improper access control flaw that lets a logged-in user gain higher privileges on the same machine. CISA lists it as actively exploited in the wild.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2025-10-14T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1507","fixed":["10.0.10240.21161"],"affected":"< 10.0.10240.21161","ecosystem":"vendor"},{"name":"microsoft windows 10 1607","fixed":["10.0.14393.8519"],"affected":"< 10.0.14393.8519","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.7919"],"affected":"< 10.0.17763.7919","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":["10.0.19044.6456"],"affected":"< 10.0.19044.6456","ecosystem":"vendor"},{"name":"microsoft windows 10 22h2","fixed":["10.0.19045.6456"],"affected":"< 10.0.19045.6456","ecosystem":"vendor"},{"name":"microsoft windows 11 22h2","fixed":["10.0.22621.6060"],"affected":"< 10.0.22621.6060","ecosystem":"vendor"},{"name":"microsoft windows 11 23h2","fixed":[],"affected":"<= 10.0.22631.6060","ecosystem":"vendor"},{"name":"microsoft windows 11 24h2","fixed":["10.0.26100.6899"],"affected":"< 10.0.26100.6899","ecosystem":"vendor"},{"name":"microsoft windows 11 25h2","fixed":["10.0.26200.6899"],"affected":"< 10.0.26200.6899","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":[],"affected":"<= 10.0.14393.8519","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.7919"],"affected":"< 10.0.17763.7919","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.4294"],"affected":"< 10.0.20348.4294","ecosystem":"vendor"},{"name":"microsoft windows server 2022 23h2","fixed":["10.0.25398.1913"],"affected":"< 10.0.25398.1913","ecosystem":"vendor"},{"name":"microsoft windows server 2025","fixed":[],"affected":"<= 10.0.26100.6899","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","remote-access","rras","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2025-59230 per vendor instructions; the sources do not name the patch KB or build numbers.","status":"open","published_at":"2025-10-14T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:33+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:44:33Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2025-59230 per vendor instructions; the sources do not name the patch KB or build numbers.","reach":"local","summary":"Windows Remote Access Connection Manager has an improper access control flaw that lets a logged-in user gain higher privileges on the same machine. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["windows","remote-access","rras"],"confidence":0.7,"needs_auth":"yes","worst_case":"A low-privilege local user gains SYSTEM-level control of the Windows machine.","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2025-59230 to get affected Windows builds, patch KB numbers and any detection guidance.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000427,"input_tokens":2532,"output_tokens":347,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':174C '-2025':17A,20A '-59230':18A,21A '10':26A,30A,34A,38A,42A '11':46A,50A,54A,58A '1507':27A '1607':31A '1809':35A '2008':63A,67A '2012':71A,75A '2016':79A '2019':83A '2022':87A,91A '2025':96A '21h2':39A '22':173C '22h2':43A,47A '23h2':51A,92A '24h2':55A '25h2':59A 'access':2A,7A,101B,106B,112B,143C,149C 'action':164C 'activ':133B 'allow':10A,154C 'appli':165C 'applic':171C 'attack':13A,157C 'author':12A,156C 'bod':172C 'cisa':129B,162C 'cloud':177C 'connect':8A,107B,150C 'contain':140C 'control':3A,113B,144C 'could':153C 'cve':16A,19A 'discontinu':180C 'elev':15A,159C 'exploit':97B,134B 'flaw':114B 'follow':170C 'gain':122B 'guidanc':175C 'higher':123B 'improp':1A,111B,142C 'infrastructur':98B 'instruct':169C 'let':116B 'list':130B 'local':161C 'log':119B 'logged-in':118B 'machin':128B 'manag':9A,108B,151C 'microsoft':22A,24A,28A,32A,36A,40A,44A,48A,52A,56A,60A,64A,68A,72A,76A,80A,84A,88A,93A,138C 'mitig':166C,186C 'per':167C 'privileg':124B,160C 'product':184C 'remot':6A,100B,105B,148C 'remote-access':99B 'requir':163C 'rras':102B 'server':62A,66A,70A,74A,78A,82A,86A,90A,95A 'servic':178C 'unavail':188C 'use':181C 'user':121B 'vendor':168C 'vulner':145C 'wild':137B 'window':5A,103B,104B,139C,147C 'windows':23A,25A,29A,33A,37A,41A,45A,49A,53A,57A,61A,65A,69A,73A,77A,81A,85A,89A,94A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-10-14T00:00:00+00:00","kev":{"dateAdded":"2025-10-14","dueDate":"2025-11-04","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-59230","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-59230","severity":null,"published_at":"2025-10-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-59230","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59230","severity":null,"published_at":"2025-10-14T17:16:04+00:00","modified_at":"2026-06-17T09:45:46+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}