Skip to content

CVE · Exploited · On CISA KEV

CVE-2025-59230

Microsoft Windows Improper Access Control Vulnerability

7.8
CVSS 3.1
1
story
OCT 14
added to KEV
Severity
7.8 High · vendor score
Vendor
Microsoft
Product
Windows
Published
Oct 14, 2025
Added to KEV
Oct 14, 2025
KEV deadline
Nov 4, 2025
Ransomware use
Unknown
Weakness
CWE-284

What it is

Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. VulnerabilitiesMicrosoft Fixes Actively Exploited Flaws in Patch Tuesday ReleaseMicrosoft issued fixes for several actively exploited vulnerabilities in its latest patch Tuesday release.LINDSEY O'DONNELL-WELCH · 2 MIN

Official references

6 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorymsrc.microsoft.com/update-guide/vulnerability/CVE-2025-59230Fixvicarius.io/vsociety/posts/cve-2025-59230-mitigation-script-elevation-of-privilege-vulnerability-affecting-windows-rasmanAnalysisvicarius.io/vsociety/posts/cve-2025-59230-detection-script-elevation-of-privilege-vulnerability-affecting-windows-rasman