Windows Remote Access Connection Manager Flaw Allows Arbitrary Code Execution

Gbhackers •Divya • December 15, 2025

Security researchers have uncovered a critical unpatched vulnerability in the Windows Remote Access Connection Manager (RasMan) service that enables attackers to crash the service and facilitate local arbitrary code execution with Local System privileges. This discovery emerged during an investigation of CVE-2025-59230, which Microsoft patched in October 2025. CVE-2025-59230 represents an elevation-of-privilege vulnerability conceptually similar […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Windows RasMan Vulnerability Allows Arbitrary Code Execution A critical vulnerability in the Windows Remote Access Connection Manager (RasMan) has been identified, allowing local attackers to execute arbitrary code with System privileges. This issue was linked to CVE-2025-59230, which Microsoft addressed in its October 2025 security updates. Security analysts discovered that the exploit relies on a secondary, previously unknown zero-day flaw. 3 sources 51

Extracted Entities

CVEs (1)

CVE-2025-59230

Platforms (1)

Windows