Windows Remote Access Connection Manager Elevation of Privilege

CVE-2025-59230 is an elevation-of-privilege vulnerability in the Windows Remote Access Connection Manager (RasMan) service caused by improper access control. Available reporting indicates the issue centers on how RasMan handles RPC endpoint registration. If RasMan is not running, a local attacker can register a specific trusted RPC endpoint before the legitimate service starts. Privileged services that trust and connect to that endpoint may then interact with the attacker-controlled process instead of RasMan, enabling privilege escalation. Microsoft described the flaw as allowing an authorized attacker to elevate privileges locally, and multiple reports state successful exploitation can result in SYSTEM-level privileges. The vulnerability was reported as actively exploited in the wild and patched by Microsoft in the October 2025 security updates.