CVE-2025-62474: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
Other sources
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.8688Patch KB5071543 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.7462Fixed in 10.0.26100.7392Patch KB5072014 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.6345Patch KB5071417 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.25398.2025Patch KB5071542 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.7462Fixed in 10.0.26200.7392Patch KB5072014 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19045.6691Patch KB5071546 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.9200.25815Patch KB5071505 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.6691Patch KB5071546 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.9600.22920Patch KB5071503 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.4529Fixed in 10.0.20348.4467Patch KB5071413 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.1.7601.28064Patch KB5071506 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.8146Patch KB5071544
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62474?
CVE-2025-62474 has been classified as an elevation of privilege vulnerability.
What type of vulnerability is CVE-2025-62474?
CVE-2025-62474 is an improper access control vulnerability found in Windows Remote Access Connection Manager.
How do I fix CVE-2025-62474?
To fix CVE-2025-62474, update the affected Microsoft Windows products with the latest security patches.
What versions of Windows are affected by CVE-2025-62474?
CVE-2025-62474 affects multiple versions of Windows including Windows Server 2008 R2, Windows Server 2012, Windows 10 and Windows 11.
Can an attacker exploit CVE-2025-62474 remotely?
No, CVE-2025-62474 requires local access for an attacker to exploit the vulnerability.