Vulnerability Summary

• Vulnerability Name: Windows Remote Access Connection Manager (RasMan) Privilege Escalation
• CVE ID: CVE-2025-62472
• CVSS Score: 7.8
• Severity: High
• Vulnerability Type: Local Privilege Escalation
• CWE: Improper Initialization / Uninitialized Resource Usage
• Attack Vector: Local
• Attack Complexity: Low
• Privileges Required: Low (local user access required)
• User Interaction: None
• Scope: Unchanged
• Impact:
  • Confidentiality: High
  • Integrity: High
  • Availability: High
• Exploitability: No public exploits reported at the time of patch release
• Patch Availability: Yes (December 2025 cumulative updates)

Overview

Microsoft has addressed a serious local privilege escalation vulnerability in the Windows Remote Access Connection Manager (RasMan) service, tracked as CVE-2025-62472. This issue affects nearly every modern version of Windows, both client and server, making it one of the more widespread Windows security flaws fixed in the December 2025 security updates.

The vulnerability exists in how the RasMan service handles internal system resources. Under certain conditions, a local attacker can abuse this flaw to gain SYSTEM-level privileges, which is the highest level of access on a Windows machine.

What Is the RasMan Vulnerability?

RasMan is a core Windows service responsible for managing VPN and dial-up connections. The vulnerability is caused by uninitialized resource usage, meaning the service may act on system resources that were never properly set up or validated.

If exploited, this flaw allows an attacker who already has local access to a system to elevate their privileges from a standard user to SYSTEM. While it does not allow remote compromise on its own, it significantly increases the impact of phishing attacks, malware infections, or insider threats.

This issue should not be confused with CVE-2025-62221, which affects Windows Cloud Files. CVE-2025-62472 is specific to RasMan.

Why This Vulnerability Affects So Many Systems

The RasMan service has been part of Windows networking for well over a decade. Because the vulnerable code exists in shared components used across many Windows versions, the issue impacts nearly all supported releases of Windows.

In short, if your system runs Windows and receives security updates, it is almost certainly affected until patched.

Affected Windows Versions

Client Operating Systems

• Windows 11
  • Version 23H2
  • Version 24H2
  • Version 25H2
• Windows 10
  • Version 22H2
  • Version 21H2
  • Version 1809
  • Older LTSC/LTSB editions, including 1607

Server Operating Systems

• Windows Server 2025
  • Standard and Server Core
• Windows Server 2022
  • Standard, Datacenter, and Server Core
• Windows Server 2019
  • All editions
• Windows Server 2016
  • All editions
• Windows Server 2012 / 2012 R2
  • Requires Extended Security Updates (ESU)
• Windows Server 2008 / 2008 R2
  • Requires ESU to receive the patch

Required Action: Install the December 2025 Updates

Microsoft fixed CVE-2025-62472 as part of the December 2025 cumulative updates. There is no standalone fix; the vulnerability is resolved only by installing the appropriate monthly update for your operating system.

Official Patch References (December 9, 2025 Release)

Note: Windows 11 (24H2) and Windows Server 2025 now share the same KB number. This is expected and reflects Microsoft’s unified servicing model for newer Windows builds.

How to Confirm the Patch Installed Correctly

After applying the update, verify the operating system build number:

• Windows 11 24H2 / 25H2: 26100.7462 or 26200.7462
• Windows 11 23H2: 22631.6345
• Windows Server 2022: 20348.4467

If the build number does not match, the update may not have installed successfully.

Notes on Hotpatching (Server 2025)

If you are running Windows Server 2025 Azure Edition, you may see a smaller update due to Microsoft’s Hotpatch capability. This is normal. The standard cumulative update (KB5072033) still applies and can be installed if a full reboot cycle is required.

Deploying the Patch Across an Enterprise Environment

Deployment via WSUS

1. Synchronize updates and ensure Security Updates and Critical Updates are selected.
2. Approve the December 2025 cumulative updates for the relevant Windows versions.
3. Assign approvals to pilot or production computer groups.
4. Monitor installation status through WSUS reports.

Deployment via SCCM / MECM

1. Synchronize software updates from the Software Update Point.
2. Create a Software Update Group (SUG) for December 2025 security updates.
3. Download the updates to distribution points.
4. Deploy the SUG as Required with an appropriate deadline.
5. Monitor compliance through the deployment dashboard.

Reboot Requirement

This update modifies core Windows system components. A system reboot is mandatory for the RasMan fix to take effect. Systems that do not restart remain vulnerable until the update is fully applied.

Final Takeaway

CVE-2025-62472 is a classic example of a low-visibility but high-impact Windows vulnerability. While it requires local access to exploit, privilege escalation flaws like this are frequently chained with other attacks to gain full system control.

Applying the December 2025 cumulative updates across all Windows endpoints and servers closes this risk and should be treated as a priority in patch management cycles.