Patch Tuesday is upon us again; thankfully, it’s a light month of Always On VPN administrators. The Microsoft monthly security updates for June 2025 include just a few Windows Routing and Remote Access Service (RRAS) fixes. In addition, an update is available for a vulnerability in the Windows Remote Access Connection Manager. Significantly, DirectAccess administrators are affected this month by a vulnerability identified in the Windows KDC Proxy Service (KPSSVC).
RRAS Updates
The Microsoft security updates for June 2025 address the following CVEs for Windows Server RRAS.
Both RRAS CVEs are Remote Code Execution (RCE) vulnerabilities with max severity ratings of Important.
Remote Access Connection Manager
A security vulnerability in the Windows Remote Access Connection Manager is addressed with the following CVE.
An attacker exploiting this vulnerability could elevate local access privileges.
KDC Proxy
This critical vulnerability affects those organizations still supporting Microsoft DirectAccess in their environments.
This CVE addresses an RCE in the KDC Proxy Service (KPSSVC) that could allow an attacker to execute arbitrary code over the network. DirectAccess administrators are encouraged to apply this update as soon as possible.
