CVE-2025-60713: Windows Server 2016 Privilege Escalation

CVE-2025-60713 Overview

CVE-2025-60713 is a local privilege escalation vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw stems from an untrusted pointer dereference [CWE-822] within the RRAS component shipped with multiple Windows Server editions. An authenticated attacker with low-privileged local access can trigger the dereference to execute code in the context of a higher-privileged process. Microsoft rates the issue as HIGH severity with a CVSS 3.1 base score of 7.8. The vulnerability affects Windows Server 2016 through Windows Server 2025, including 23H2. No public proof-of-concept exploit or in-the-wild exploitation has been reported as of publication.

Critical Impact
Successful exploitation grants an authenticated local attacker full confidentiality, integrity, and availability impact on the affected server, enabling elevation to SYSTEM-level privileges on core Windows Server platforms.

Affected Products

Microsoft Windows Server 2016 and Windows Server 2019
Microsoft Windows Server 2022 and Windows Server 2022 23H2
Microsoft Windows Server 2025

Discovery Timeline

2025-11-11 - CVE-2025-60713 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60713

Vulnerability Analysis

The vulnerability resides in the Windows Routing and Remote Access Service (RRAS), the Microsoft component that provides routing, VPN, and dial-up remote access services. RRAS runs as a privileged service and exposes several IOCTL and RPC interfaces to local callers. This flaw is classified under [CWE-822] Untrusted Pointer Dereference, meaning the service dereferences a pointer whose value originates from or can be influenced by a lower-privileged caller. When an attacker supplies a crafted pointer value through the affected RRAS interface, the service dereferences it without validating that the address belongs to a trusted region. This allows attacker-controlled data to be read or written at an arbitrary kernel or service-controlled location, resulting in local privilege escalation.

Root Cause

The root cause is insufficient validation of pointer values received from user-mode callers before dereference inside the RRAS code path. Because RRAS accepts input from lower-integrity callers, any pointer field passed through the interface must be validated against expected memory ranges or replaced with a service-owned handle. The missing validation allows an authorized local attacker to redirect execution or corrupt memory used by the privileged service.

Attack Vector

Exploitation requires local access and low-level authenticated privileges on the target Windows Server. The attacker interacts with the RRAS service through its exposed local interface and passes a malicious pointer value that the service dereferences. No user interaction is required, and the attack complexity is low. Because RRAS is enabled by default only when the Remote Access role is installed, servers without that role are not directly exposed through the service interface. See the Microsoft CVE-2025-60713 Advisory for authoritative technical details.

No verified public exploit code is available for CVE-2025-60713 at the time of writing. Refer to Microsoft's advisory for confirmed technical details on the affected code path.

Detection Methods for CVE-2025-60713

Indicators of Compromise

Unexpected crashes, restarts, or access violations in the RemoteAccess or RasMan services recorded in the System event log.
Creation of new SYSTEM-level processes as children of svchost.exe hosting RRAS following interaction from a non-administrative user session.
Anomalous local RPC or IOCTL traffic to RRAS interfaces originating from user-mode processes that do not normally use remote access APIs.

Detection Strategies

Monitor for process integrity level transitions where a medium-integrity process spawns or influences a SYSTEM process associated with RRAS.
Correlate service crash telemetry (Event ID 7031, 7034, 1000) referencing RRAS binaries with subsequent privileged process launches.
Baseline expected callers of RRAS local RPC endpoints and alert on unknown processes opening handles to RRAS device objects.

Monitoring Recommendations

Ingest Windows Security, System, and Sysmon logs into a centralized analytics platform and retain them for post-incident review.
Track installation state of the Remote Access role across the fleet so unpatched servers running RRAS are prioritized for remediation.
Enable command-line and module-load auditing on servers running RRAS to detect tool-based exploitation attempts.

How to Mitigate CVE-2025-60713

Immediate Actions Required

Apply the November 2025 Microsoft security updates that address CVE-2025-60713 to all affected Windows Server versions.
Inventory servers with the Remote Access role installed and confirm patch deployment on each host.
Restrict interactive and remote-shell logon rights on RRAS-hosting servers to reduce the number of accounts capable of exploiting the flaw.

Patch Information

Microsoft has published fixes through the Update Guide. Administrators should install the cumulative updates listed in the Microsoft CVE-2025-60713 Advisory for Windows Server 2016, 2019, 2022, 2022 23H2, and 2025. Apply the updates through Windows Update, WSUS, or the Microsoft Update Catalog and reboot affected systems to complete installation.

Workarounds

If patching cannot be performed immediately, disable the Routing and Remote Access service on hosts that do not require VPN, routing, or dial-up functionality.
Remove the Remote Access server role on systems where it was installed for testing or is no longer in use.
Enforce least privilege on all interactive accounts and remove local logon rights from service and application accounts where feasible.

bash

# Example: disable RRAS on servers that do not require the role
sc.exe config RemoteAccess start= disabled
sc.exe stop RemoteAccess

# Verify the Remote Access role state before removal
Get-WindowsFeature -Name RemoteAccess
Uninstall-WindowsFeature -Name RemoteAccess -Restart