CVE-2025-47993: Windows 11 24h2 Privilege Escalation Flaw

CVE-2025-47993 Overview

CVE-2025-47993 is an improper access control vulnerability [CWE-284] in Microsoft PC Manager that allows an authenticated local attacker to elevate privileges on affected Windows systems. Microsoft published the advisory on July 8, 2025. The flaw affects Windows 11 24H2, Windows Server 2022 23H2, and Windows Server 2025. Successful exploitation grants an attacker access at a higher privilege level than originally authorized, compromising confidentiality, integrity, and availability of the host.

Critical Impact
An authenticated local attacker can elevate privileges on affected Windows hosts, gaining high-impact control over confidentiality, integrity, and availability.

Affected Products

Microsoft Windows 11 24H2
Microsoft Windows Server 2022 23H2
Microsoft Windows Server 2025

Discovery Timeline

2025-07-08 - CVE-2025-47993 published to NVD
2025-07-08 - Microsoft releases security update for CVE-2025-47993
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47993

Vulnerability Analysis

CVE-2025-47993 stems from improper access control in Microsoft PC Manager, a system utility bundled with recent Windows builds. The component fails to enforce authorization boundaries between low-privileged users and privileged operations executed by the utility. An attacker with a valid local account can abuse this weakness to run code or perform actions in the context of a higher-privileged process. The result is a local elevation of privilege on the affected host, with high impact to confidentiality, integrity, and availability. The vulnerability requires no user interaction and can be triggered entirely from an authenticated local session.

Root Cause

The root cause is a violation of [CWE-284] (Improper Access Control) within Microsoft PC Manager. Privileged functionality is exposed to callers without adequate verification that the caller holds the necessary privileges. Microsoft has not published low-level technical details in the public advisory.

Attack Vector

Exploitation is local. An attacker must already have code execution on the target system as an authenticated user with low privileges. From that position, the attacker interacts with the vulnerable PC Manager component to obtain elevated privileges. Network access is not required, and no user interaction is needed. See the Microsoft Security Update Guide for CVE-2025-47993 for vendor details.

Detection Methods for CVE-2025-47993

Indicators of Compromise

Unexpected child processes spawned by Microsoft PC Manager binaries running under SYSTEM or other elevated contexts.
Local user accounts suddenly performing administrative actions without a corresponding UAC prompt or admin logon event.
New services, scheduled tasks, or registry autoruns created shortly after PC Manager activity by a non-admin session.

Detection Strategies

Monitor for anomalous process lineage where PC Manager components launch shells (cmd.exe, powershell.exe) or LOLBins.
Correlate low-privileged user sessions with subsequent high-integrity process creation events on the same host.
Baseline normal PC Manager behavior and alert on deviations such as unexpected file writes into protected directories.

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging to capture privilege transitions.
Ingest endpoint telemetry into a centralized data lake to correlate PC Manager activity with subsequent privileged actions.
Alert on privilege escalation patterns matching MITRE ATT&CK technique T1068 (Exploitation for Privilege Escalation).

How to Mitigate CVE-2025-47993

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-47993 to all affected Windows 11 24H2, Windows Server 2022 23H2, and Windows Server 2025 hosts.
Inventory endpoints and servers to confirm Microsoft PC Manager version and patch status.
Restrict interactive logon on servers to trusted administrative accounts to reduce local attack surface.

Patch Information

Microsoft has published a security update addressing CVE-2025-47993. Administrators should consult the Microsoft Security Update Guide entry for CVE-2025-47993 for the applicable KB articles and deployment guidance for each supported Windows build.

Workarounds

Where the update cannot be applied immediately, remove or disable Microsoft PC Manager on systems that do not require it.
Enforce least-privilege policies so that untrusted users cannot obtain interactive local sessions on sensitive hosts.
Apply application control (Windows Defender Application Control or AppLocker) to block execution of unneeded PC Manager components.

bash

# Example: query PC Manager installation state via PowerShell
Get-AppxPackage -AllUsers | Where-Object { $_.Name -like "*PCManager*" }

# Example: remove the package for all users if not required
Get-AppxPackage -AllUsers | Where-Object { $_.Name -like "*PCManager*" } | Remove-AppxPackage -AllUsers