Hackers Exploit Windows Remote Access Connection Manager 0-Day in Ongoing Attacks

According to Microsoft Threat Intelligence Center and Microsoft Security Response Center, active exploitation of a critical zero-day vulnerability affecting the Windows Remote Access Connection Manager has been detected in real‑world attacks, designated as CVE-2025-59230. Disclosed on 14 October 2025, the flaw allows attackers with limited system access to escalate privileges to the highest level, gaining complete control over compromised systems.

The vulnerability arises from improper access control within the Windows Remote Access Connection Manager, a service that handles remote network connections across Windows operating systems. It has a CVSS base score of 7.8 and a temporal score of 7.2, and is rated as Important in severity.

The attack requires local access, with exploitation described as straightforward due to low attack complexity and no user interaction, potentially enabling privilege escalation to SYSTEM and unrestricted data read, modification or deletion, as well as persistence and the creation of new administrator accounts. Microsoft’s findings also indicate that exploit code exists and is being leveraged in the wild, underscoring the urgency for immediate patching of affected systems.