CVE-2025-47955: Privilege Escalation in Windows Remote Access Connection Manager

Successful exploitation of CVE-2025-47955 allows an attacker who has already gained some level of access to a system to significantly escalate their privileges. This could enable them to gain SYSTEM-level access, granting them complete control over the compromised machine. An attacker could then install malware, steal sensitive data, modify system configurations, or pivot to other systems on the network. The impact is particularly severe in environments where user accounts have elevated privileges or where Remote Access Connection Manager is used to manage connections for privileged users. This vulnerability shares similarities with other privilege escalation flaws where improper access controls are exploited to gain higher permissions.

1. Reserved2025-05-14
2. Published2025-06-10
3. Modified2026-02-20
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-47955 is to upgrade the Windows Remote Access Connection Manager to version 10.0.26100.4061 or later. If immediate patching is not possible, consider implementing least privilege principles to restrict user access and limit the potential impact of a successful exploit. Review existing group policies and user account permissions to ensure they adhere to the principle of least privilege. While a direct workaround isn't available, monitoring for suspicious privilege escalation attempts is crucial. After upgrading, confirm the fix by attempting to execute a process with a lower privilege level and verifying that it is denied.