CVE-2025-59230
Published: 14 October 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-59230 is an improper access control vulnerability (CWE-284) in the Windows Remote Access Connection Manager (RasMan) service. Published on 2025-10-14, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and enables local privilege escalation on affected Windows systems.
The vulnerability can be exploited by an authorized local attacker possessing low privileges. Exploitation requires low complexity and no user interaction, allowing the attacker to elevate privileges and achieve high impacts on confidentiality, integrity, and availability.
Microsoft's update guide provides details on the vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59230. Vicarius offers a detection script and a mitigation script tailored to this elevation of privilege issue in Windows RasMan, available at https://www.vicarius.io/vsociety/posts/cve-2025-59230-detection-script-elevation-of-privilege-vulnerability-affecting-windows-rasman and https://www.vicarius.io/vsociety/posts/cve-2025-59230-mitigation-script-elevation-of-privilege-vulnerability-affecting-windows-rasman, respectively.
The vulnerability appears in CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59230, indicating real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 14 October 2025
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
CVE-2025-59230 is an improper access control vulnerability in Windows RasMan service enabling local privilege escalation, directly mapping to Exploitation for Privilege Escalation (T1068).