CVE-2025-59230

ENISA EUVD: EUVD-2025-34258 ↗

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 7 articles Published: 2025-10-14

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23

4.97%

probability

This CVE has a 4.97% probability of being exploited in the next 30 days.

0% Top 89.8th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)

7.8

HIGH

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Temporal

Exploit Code Maturity

Functional

Remediation Level

Official Fix

Report Confidence

Confirmed

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Description

NVD

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

Affected Products

Microsoft

Windows 10 Version 1507

10.0.10240.0

Microsoft

Windows 10 Version 1607

10.0.14393.0

Microsoft

Windows 10 Version 1809

10.0.17763.0

Microsoft

Windows 10 Version 21H2

10.0.19044.0

Microsoft

Windows 10 Version 22H2

10.0.19045.0

microsoft

windows 10 1507

microsoft

windows 10 1607

microsoft

windows 10 1809

microsoft

windows 10 21h2

microsoft

windows 10 22h2

Microsoft

Windows Server 2012

6.2.9200.0 <6.2.9200.25722

Microsoft

Windows Server 2016 (Server Core installation)

10.0.14393.0 <10.0.14393.8519

Microsoft

Windows 10 Version 1607

10.0.14393.0 <10.0.14393.8519

Microsoft

Windows 10 Version 1507

10.0.10240.0 <10.0.10240.21161

Microsoft

Windows Server 2008 Service Pack 2

6.0.6003.0 <6.0.6003.23571

Microsoft

Windows Server 2012 R2 (Server Core installation)

6.3.9600.0 <6.3.9600.22824

Microsoft

Windows Server 2025 (Server Core installation)

10.0.26100.0 <10.0.26100.6899

Microsoft

Windows Server 2025

10.0.26100.0 <10.0.26100.6899

Microsoft

Windows Server 2022, 23H2 Edition (Server Core installation)

10.0.25398.0 <10.0.25398.1913

Microsoft

Windows Server 2019

10.0.17763.0 <10.0.17763.7919

Microsoft

Windows Server 2022

10.0.20348.0 <10.0.20348.4294

Microsoft

Windows 10 Version 22H2

10.0.19045.0 <10.0.19045.6456

Microsoft

Windows 11 version 22H3

10.0.22631.0 <10.0.22631.6060

Microsoft

Windows Server 2016

10.0.14393.0 <10.0.14393.8519

Microsoft

Windows Server 2012 (Server Core installation)

6.2.9200.0 <6.2.9200.25722

Microsoft

Windows 10 Version 21H2

10.0.19044.0 <10.0.19044.6456

Microsoft

Windows 11 version 22H2

10.0.22621.0 <10.0.22621.6060

Microsoft

Windows 11 Version 23H2

10.0.22631.0 <10.0.22631.6060

Microsoft

Windows Server 2008 R2 Service Pack 1

6.1.7601.0 <6.1.7601.27974

Microsoft

Windows Server 2012 R2

6.3.9600.0 <6.3.9600.22824

Microsoft

Windows Server 2008 R2 Service Pack 1 (Server Core installation)

6.1.7601.0 <6.1.7601.27974

Microsoft

Windows 11 Version 25H2

10.0.26200.0 <10.0.26200.6899

Microsoft

Windows Server 2008 Service Pack 2 (Server Core installation)

6.0.6003.0 <6.0.6003.23571

Microsoft

Windows 10 Version 1809

10.0.17763.0 <10.0.17763.7919

Microsoft

Windows 11 Version 24H2

10.0.26100.0 <10.0.26100.6899

Microsoft

Windows Server 2019 (Server Core installation)

10.0.17763.0 <10.0.17763.7919

Attack Intelligence

CWE-284 · Improper Access Control

Google Project Zero

Patched

Oct. 14, 2025

Reported by

Microsoft Threat Intelligence Center (MSTIC) & Microsoft Security Response Center (MSRC)

Root Cause Analysis

???

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59230

vendor-advisory patch

Signal Intelligence

Confidenceⓘ

92%

EPSS 4.97%

CVSS v3.1 7.8

Mentions 7

Last Seen Apr 14, 2026

CNA Information

CNA Assigner

microsoft

CNA Title

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

Analyst Note

This CVE is confirmed as a zero-day with strong supporting evidence: it appears in Google Project Zero, has been included in Microsoft's official patch Tuesday releases, and is documented across multiple reputable security sources (TheHackerNews, BleepingComputer) confirming active exploitation. The HIGH severity rating (CVSS 7.8) combined with the privileged escalation nature of the vulnerability and documented unofficial patches validates the confirmed status.