Microsoft
Microsoft Windows Access Control Flaw Vulnerability
At a glance
Actively exploited in the wild — prioritise confirming exposure.
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on Microsoft Windows, treat it as High.
Briefing
- Do not treat uncorroborated claims as confirmed breaches.
Questions to ask IT
- Do we run Microsoft Windows, and which versions?
- Is any of it reachable from the internet?
- Have we checked whether it has already been used against us?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 11 Nov?
Next steps
- Confirm exposure, mitigation status and any service interruption risk.
Vulnerability facts
Full CVE detail CVE-2025-59230- 7.8 · HighExploitable only with local access and a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Listed: attacks using it have been seen (on the catalogue since )
- ~2.7% estimated chance of attack in 30 days
- CVE-2025-59230 has estimated attack likelihood 0.02584 (~2.6% estimated chance of exploitation in 30 days; 83.7th percentile) as of 2026-07-31 — probability signal, not confirmed exploitation
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorised attacker to elevate privileges locally.
- CVE-2025-59230 is listed in known-exploited catalogue (exploitation in the wild)
- 6% estimated chance of exploitation in 30 days; 83.
- Authoritative catalogues report active exploitation of this vulnerability.
Why this matters in the UK
- Known-exploited catalogue reports exploitation in the wild
Products and services involved
- Microsoft Windows98% match confidence · CVE-2025-59230
Pulse
Last checked 4d ago · Recheck overdue since 5 Nov 2026, 23:07 UK time · 2 quiet checks collapsed
Suggested changed to 7d.
Listed on the — prioritise confirming exposure and patching.
1 quiet check hidden.
Sources
Microsoft Windows Improper Access Control Vulnerability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ConfirmedHeadline90% confidence
Microsoft Windows Improper Access Control Vulnerability
- ConfirmedSummary fact75% confidence
Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorised attacker to elevate privileges locally. Affects Microsoft Windows. Known ransomware campaign use: Unknown. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2025-59230
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2025-59230 is listed in known-exploited catalogue (exploitation in the wild)
- ConfirmedEstimated attack likelihood95% confidence
CVE-2025-59230 has estimated attack likelihood 0.02584 (~2.6% estimated chance of exploitation in 30 days; 83.7th percentile) as of 2026-07-31 — probability signal, not confirmed exploitation