Windows RasMan CVE-2025-62474

Requires the attacker to already have local, authenticated access to the target Windows system with at least low (standard-user) privileges, and the ability to run code that reaches the Remote Access Connection Manager (RasMan) service - a component enabled by default on all Windows editions. No user interaction is required (UI:N) and no special non-default configuration is indicated. Exploitation is fundamentally LIMITED by the local attack vector (AV:L): it cannot be triggered remotely and cannot be used for initial access, only for post-compromise privilege escalation to SYSTEM.

This is a local elevation-of-privilege flaw in the Windows Remote Access Connection Manager (RasMan) service, a core component present across the entire supported Windows client and server line (Windows 10 1607 through Windows 11 25H2, Server 2008 R2 through Server 2025). The vendor CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) is internally consistent and I agree with it: exploitation requires local access and low existing privileges but no user interaction, and yields full CIA compromise (SYSTEM). The severity comes from impact, not reach - this is not a remotely exploitable issue. Signals converge on MODERATE real-world priority: EPSS is low (0.37%, 28th percentile), there is no CISA KEV listing, and no public POC is identified, so exploitation is no public exploit identified at time of analysis. The one caveat is that local privilege-escalation bugs in ubiquitous OS services are historically favored as post-compromise components in exploit chains and ransomware operators, so despite the low EPSS this warrants patching on the standard Patch-Tuesday cycle rather than deferral. Note the input Tags label this 'Authentication Bypass,' which conflicts with the CWE-284 improper-access-control / privilege-elevation description - the description and CWE are authoritative here.

An attacker who already has an unprivileged foothold on a Windows host (via phishing, a low-privilege service account, or a compromised standard user) invokes the vulnerable Remote Access Connection Manager code path to abuse improper access control and elevate to SYSTEM. Because the CVSS vector is AV:L/PR:L/UI:N, no victim interaction and no admin credentials are needed - only local code execution as a normal user. No public exploit code has been identified, so an attacker would need to develop the primitive.