Microsoft Windows Improper Access Control Vulnerability

Technical Severity

CVSS v3.1 Metrics

HIGH

7.8 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Exploitation Likelihood

EPSS Prediction

3.72 %

Predictive Probability

Percentile Rank

87.9 th

Documented as more likely to be exploited than 87.9% of known CVEs.

Detection Date

Oct 14, 2025

Remediation Due

Nov 04, 2025

CISA Catalog Active

Threat Analysis

Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.

Remediation Directive

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

External Intelligence

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-59230

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2025-59230