VDB
CVE-2025-59510
CVE-2025-59510
PUBLISHED
CVSS 5.5 MEDIUM
Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability
Reported by microsoft · Published November 11, 2025
Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Windows 11 version 22H3 | Microsoft | 10.0.22631.6199 |
| windows_server_2019 | microsoft | 10.0.17763.8027 |
Risk scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows 10 Version 1607 | 10.0.14393.0 |
| Microsoft | Windows 10 Version 1809 | 10.0.17763.0 |
| Microsoft | Windows 10 Version 21H2 | 10.0.19044.0 |
| Microsoft | Windows 10 Version 22H2 | 10.0.19045.0 |
| Microsoft | Windows 11 version 22H3 | 10.0.22631.0 |
| Microsoft | Windows 11 Version 23H2 | 10.0.22631.0 |
| Microsoft | Windows 11 Version 24H2 | 10.0.26100.0 |
| Microsoft | Windows 11 Version 25H2 | 10.0.26200.0 |
| Microsoft | Windows Server 2012 R2 | 6.3.9600.0 |
| Microsoft | Windows Server 2012 R2 (Server Core installation) | 6.3.9600.0 |
| Microsoft | Windows Server 2016 | 10.0.14393.0 |
| Microsoft | Windows Server 2016 (Server Core installation) | 10.0.14393.0 |
| Microsoft | Windows Server 2019 | 10.0.17763.0 |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.17763.0 |
| Microsoft | Windows Server 2022 | 10.0.20348.0 |
| Microsoft | Windows Server 2022, 23H2 Edition (Server Core installation) | 10.0.25398.0 |
| Microsoft | Windows Server 2025 | 10.0.26100.0 |
| Microsoft | Windows Server 2025 (Server Core installation) | 10.0.26100.0 |
| Microsoft | Windows 11 version 22H3 | 10.0.22631.0 |
| Microsoft | Windows 10 Version 1809 | 10.0.17763.0 |
…and 29 more
Timeline
- Nov 11, 2025 CVE Published
- Nov 11, 2025 PoC Published (2 in total, the first dated here)
- Nov 12, 2025 EPSS Score (30 in total, the first dated here)
- Mar 11, 2026 Security Advisory (44 in total, the first dated here)
- Mar 26, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-59510
vulnetix vdb fixes CVE-2025-59510Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-59510/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability vendor-advisorypatch