Windows Remote Access Connection Manager Vulnerabilities Let Attackers Escalate Privileges

Two Important privilege escalation vulnerabilities in the Windows Remote Access Connection Manager (CVE-2025-62472 and CVE-2025-62474) were disclosed on December 9, 2025; both allow local, low-privileged attackers to obtain SYSTEM privileges, are rated CVSS 7.8, affect multiple Windows Server, Windows 11 and Windows 10 builds, and Microsoft released security updates across supported platforms the same day, while noting no public active exploitation to date.