Windows Remote Access Connection Manager (RasMan) Local Privilege Escalation Vulnerability (CVE-2025-59230) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTWindows and Windows Server systems running the Remote Access Connection Manager (RasMan) service
An authorized local attacker can elevate privileges to SYSTEM, gaining full administrative control over the affected host
Apply the latest Microsoft cumulative security updates immediately, or disable the RasMan service as a temporary workaround
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Applying the latest Cumulative Update (LCU) from Microsoft is the primary remediation path. You can force the installation of security updates using PowerShell.
# Install and run Windows Update module to apply the latest security patches
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck
Get-WindowsUpdate -AcceptAll -Install -AutoReboot2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, disable the RasMan service to mitigate the attack vector, provided that VPN and remote access features are not required.
# Stop and disable the Remote Access Connection Manager (RasMan) service
Stop-Service -Name 'RasMan' -Force
Set-Service -Name 'RasMan' -StartupType Disabled
# Verify the service status and startup configuration
Get-Service -Name 'RasMan' | Select-Object Name, Status, StartType3. Log Audit & IoC Verification Commands
Monitor and audit system logs for anomalous child processes spawned by the RasMan service host.
# Query Sysmon logs for suspicious processes (e.g., cmd.exe, powershell.exe) spawned under RasMan context
Get-WinEvent -FilterHashtable @{
LogName='Microsoft-Windows-Sysmon/Operational'
Id=1
} -ErrorAction SilentlyContinue | Where-Object {
$_.Message -like '*rasman*' -and ($_.Message -like '*cmd.exe*' -or $_.Message -like '*powershell.exe*')
} | Format-Table TimeCreated, Id, Message -WrapBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-59230) is caused by improper access control (CWE-284) within the Windows Remote Access Connection Manager (RasMan) service. RasMan is a core background service responsible for managing Virtual Private Network (VPN) and dial-up connections, operating under high-privilege SYSTEM context. Due to insufficient validation of access rights during inter-process communication (IPC) or shared resource handling, a low-privileged local attacker can manipulate the service's execution flow.
2. Exploitation Mechanics & Attack Scenario
To exploit this vulnerability, an attacker must first establish local access to the target Windows system with standard user privileges. The attacker then sends crafted requests to the RasMan service via exposed IPC interfaces (such as Named Pipes or RPC). By exploiting the improper access control, the attacker forces the service to load malicious payloads or redirect resource paths under the SYSTEM context. Because the RasMan service runs with elevated privileges, the injected payload executes with SYSTEM authority, resulting in local privilege escalation (EoP).
3. Infrastructure & Business Impact
As this vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, it poses an active and severe threat to enterprise environments. Attackers frequently leverage local privilege escalation exploits during the lateral movement phase after gaining an initial foothold. Successful exploitation allows adversaries to bypass Endpoint Detection and Response (EDR) agents, dump credentials (LSASS), deploy ransomware, and compromise the entire Active Directory domain.
Official Vendor Advisories & References
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
Frequently Asked SecOps Questions (CVE-2025-59230)
FAQQ1. How critical is CVE-2025-59230 and is it actively exploited in the wild?
CVE-2025-59230 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 2.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-59230?
Primary impacted vendors include microsoft across windows, windows_server. Scope summary: Windows 10, Windows 11, and Windows Server operating systems with the Remote Access Connection Manager (RasMan) service enabled
Q3. What temporary mitigations or workarounds exist for CVE-2025-59230 before patching?
[Mitigation] Apply the latest Microsoft cumulative security updates immediately, or disable the RasMan service as a temporary workaround Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-59230
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Windows IKE Extension Double Free Remote Code Execution Vulnerability (CVE-2026-33824)
[Affected Scope] Internet Key Exchange (IKE) Extension service running on Microsoft Windows and Windows Server operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Windows Remote Access Connection Manager (RasMan) Null Pointer Dereference Local DoS Vulnerability (CVE-2026-21525) Technical Advisory
[Affected Scope] Windows and Windows Server operating systems utilizing the Windows Remote Access Connection Manager (RasMan) service.
Microsoft Windows Shell Security Feature Bypass Vulnerability (CVE-2026-21510) Urgent Security Advisory
[Affected Scope] Windows Shell component across Microsoft Windows operating systems
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.