Improper Access Control in Windows Remote Access Connection Manager (CVE‑2025‑59230) Enables Local Privilege Escalation
What It Is – Microsoft Windows Remote Access Connection Manager (RAS) contains an improper access‑control flaw that can allow a locally‑authenticated attacker to elevate privileges to an administrative level.
Exploitability – The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. A public CVSS score rates it 8.2 (High).
Affected Products – Microsoft Windows (all supported client and server editions that include the Remote Access Connection Manager service).
Why It Matters for Trust & Control Assurance
- Tests the access‑control control objective: ensuring least‑privilege and proper segregation of duties across systems.
- Demonstrates the need for continuous monitoring of privilege‑escalation events and evidence of timely patch deployment.
- Provides auditors with concrete proof that an organization enforces a defensible audit trail for privileged‑access changes.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2025‑59230 immediately.
- Review and tighten local account privileges; enforce “least‑privilege” for all users.
- Enable detailed logging for RAS service activity and monitor for anomalous privilege‑escalation attempts.
- Validate that your access‑control policies are reflected in your audit evidence repository.
Source: CISA KEV – CVE‑2025‑59230