CVE-2025-62474 Overview
CVE-2025-62474 is an improper access control vulnerability [CWE-284] in the Windows Remote Access Connection Manager (RasMan) service. A locally authenticated attacker can abuse the flaw to elevate privileges on affected Windows client and server systems. Microsoft addressed the issue in the December 2025 security update cycle.
The vulnerability affects a broad set of Windows releases, from legacy Server 2008 R2 SP1 through Windows 11 25H2 and Server 2025. Successful exploitation yields high impact to confidentiality, integrity, and availability on the local host.
Critical Impact
An authorized local user can escalate to SYSTEM-level privileges by abusing the Remote Access Connection Manager, enabling full compromise of the affected Windows host.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2)
- Microsoft Windows Server 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-12-09 - CVE-2025-62474 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-62474
Vulnerability Analysis
The flaw resides in the Remote Access Connection Manager (RasMan) service, which runs as NT AUTHORITY\SYSTEM and manages dial-up and virtual private network (VPN) connections on Windows. Improper access control [CWE-284] allows an authenticated local user to interact with privileged RasMan objects or interfaces that should be restricted to higher-privileged callers.
By invoking these interfaces in an unintended sequence or against unintended targets, an attacker can cause the service to perform operations under its SYSTEM context on behalf of a low-privileged caller. This yields a local privilege escalation from a standard user to SYSTEM.
Exploitation requires that the attacker already hold valid credentials on the target host. The Remote Access Connection Manager service is enabled by default across supported Windows client and server SKUs, which widens the attack surface.
Root Cause
The root cause is missing or insufficient access checks within the Remote Access Connection Manager. Privileged operations exposed by the service do not adequately validate the caller's security context or ownership of the requested resources, violating the principle of least privilege.
Attack Vector
The attack vector is local and requires low privileges with no user interaction. A logged-in user, or code running in a compromised low-privileged process, invokes RasMan interfaces to trigger the privileged operation. Microsoft has not published exploit details, and no public proof-of-concept is currently available. See the Microsoft Security Update CVE-2025-62474 advisory for vendor guidance.
Detection Methods for CVE-2025-62474
Indicators of Compromise
- Unexpected child processes spawned by svchost.exe hosting the RasMan service, particularly command interpreters such as cmd.exe or powershell.exe running as SYSTEM.
- New or modified RasMan phonebook entries (rasphone.pbk) or connection profiles created by non-administrative users.
- Anomalous writes to registry keys under HKLM\SYSTEM\CurrentControlSet\Services\RasMan\ originating from unprivileged processes.
Detection Strategies
- Baseline the normal process tree of the RasMan service and alert on deviations, especially token elevations from a medium to high or SYSTEM integrity level.
- Correlate local logon events (Event ID 4624 type 2/3/10) with subsequent SYSTEM-level process creation events (Event ID 4688) tied to RasMan.
- Hunt for calls to RasMan RPC or COM interfaces from user-context processes that historically have not interacted with dial-up or VPN services.
Monitoring Recommendations
- Enable Windows command-line auditing and Sysmon Event ID 1 with the RasMan service scoped in configuration.
- Forward endpoint telemetry to a centralized SIEM for cross-host correlation and retention.
- Track missing December 2025 security updates across the fleet using patch-compliance reporting.
How to Mitigate CVE-2025-62474
Immediate Actions Required
- Apply the December 2025 Microsoft security updates that address CVE-2025-62474 to all affected Windows client and server systems.
- Prioritize patching on multi-user systems, jump hosts, terminal servers, and any endpoint accessible to non-administrative users.
- Audit local accounts and restrict interactive logon rights on servers to reduce the pool of potential local attackers.
Patch Information
Microsoft has released fixes through its December 2025 security update guide. Refer to the Microsoft Security Update CVE-2025-62474 advisory for KB article numbers and per-SKU update packages, and deploy via Windows Update, WSUS, Microsoft Intune, or Configuration Manager.
Workarounds
- If patching must be delayed, evaluate disabling the Remote Access Connection Manager service (RasMan) on systems that do not require dial-up or VPN connectivity, and test for application impact before rolling out broadly.
- Enforce least privilege on endpoints and remove standard users from any groups that grant unnecessary local logon rights.
- Apply application control policies such as Windows Defender Application Control or AppLocker to block untrusted binaries that could stage a local exploit.
# Configuration example: query and optionally disable RasMan where unused
sc.exe query RasMan
sc.exe config RasMan start= disabled
sc.exe stop RasMan
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
