CISA Alerts on Actively Exploited Windows Improper Access Control Flaw

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert about an actively exploited vulnerability in Microsoft Windows. The flaw sits in the Windows Remote Access Connection Manager and could allow an authorised attacker to elevate privileges locally, giving full control of an affected system. Microsoft Windows first disclosed the flaw as CVE-2025-59230, and CISA added it to its Known Exploited Vulnerabilities catalog on 14 October 2025, with a remediation deadline of 4 November 2025.

An attacker with valid credentials could use the flaw to execute code at a higher privilege level, and the advisory notes that the vulnerability is already under active exploitation in the wild. Administrators are urged to apply all Microsoft mitigations and test and deploy any vendor-issued patch; where no fix is available, guidance to disable or isolate the vulnerable service should be followed.