CVE Alert: CVE-2025-59220 – Microsoft – Windows Server 2022

Risk verdict

High risk of local privilege escalation on affected Windows devices; patching should be treated as a priority, pending confirmation of active exploitation indicators.

Why this matters

The flaw enables an authenticated, locally-present attacker to rise to SYSTEM via a race condition in the Bluetooth service, potentially compromising data and credentials. In enterprise fleets with Bluetooth enabled, this can enable persistence, credential access, and lateral movement from a compromised endpoint.

Most likely attack path

An attacker who already has local access and minimal privileges (no user interaction required) can trigger the race condition in the Bluetooth service to escalate privileges. The attack is local (AV:L), with low-required privileges (PR:L) and no UI required, making it feasible for commodity malware on a compromised workstation. Exploitation could enable control of the host and subsequent domain or asset access if footholds exist.

Who is most exposed

Endpoints with Bluetooth enabled—desktop and laptop workstations running Windows 10/11 and Windows Server variants listed—are most at risk, especially in remote or bring-your-own-device deployments where devices travel between networks.

Detection ideas

• Look for unexpected privilege-escalation events (e.g., 4672, 4688) originating from Bluetooth service processes.
• Monitor for Bluetooth service crashes or rapid restarts, memory corruption indicators, or anomalous driver loads.
• Detect suspicious Bluetooth-related binary or service modifications without approved change tickets.
• Identify abnormal post-exploitation activity on endpoints (unusual credential access, new admin sessions).

Mitigation and prioritisation

• Apply the official Microsoft patch as soon as available; verify in a test pilot before broad rollout.
• If KEV true or EPSS ≥ 0.5, treat as Priority 1; otherwise, maintain High with rapid remediation.
• Disable Bluetooth or enforce strict application/device controls where Bluetooth is unnecessary.
• Enforce least-privilege user policies and robust endpoint detection, with updated allowlists.
• Schedule coordinated patch windows; implement rollback and monitoring post-deployment.