• Positive Technologies expert helps patch critical Windows vulnerability
News

Positive Technologies expert helps patch critical Windows vulnerability

Before being fixed, the flaw allowed attackers to locally elevate privileges to the highest level, enabling lateral movement within the network

Sergey Bliznyuk, an expert from PT SWARM at Positive Technologies, discovered the vulnerability CVE-2025-47955, which affected 37 Microsoft products. This issue posed a significant threat to organizations, as it impacted current desktop and server versions of Windows. Exploiting the flaw could allow attackers to execute arbitrary code on corporate devices and install any software, including malware. Microsoft was notified of the issue under the responsible disclosure policy and has since patched it.

The vulnerability, located in the Remote Access Connection Manager service—a Windows component responsible for VPN connections—was rated highly dangerous, scoring 7.8 on the CVSS 3.1 scale. Installing the latest monthly security updates is essential to address the issue. If updates cannot be applied, Positive Technologies strongly recommends disabling the unpatched service, which is enabled by default in all Windows versions.

The flaw affected widely used systems like Windows 10 and 11, which account for 70% of the desktop OS market, according to StatCounter. It also impacted 19 server versions, including Windows Server 2025 and 2022, commonly used in corporate infrastructures, cloud services, and data centers. Analysts estimate nearly 30,000 server OS installations globally, with a significant portion running on Windows Server.

"This vulnerability poses a serious risk to corporate networks. Without the patch, an attacker only needs access to a non-administrative user's computer or a low-privilege terminal server to escalate their rights to the maximum level."

Sergey Bliznyuk
Sergey BliznyukSenior Penetration Testing Specialist at Positive Technologies

To mitigate this vulnerability, Positive Technologies recommends using EDR solutions like MaxPatrol EDR, which block suspicious activity on endpoints. For infrastructure monitoring, organizations should implement SIEM systems and vulnerability management tools such as MaxPatrol SIEM and MaxPatrol VM. The latter helps detect vulnerable systems and ensure critical updates are applied.

This isn't the first time Positive Technologies has helped Microsoft address security gaps. In July 2025, researchers reported vulnerabilities CVE-2025-49686 and CVE-2025-49689, each of which affected nearly 40 operating systems.