What is the CVSS score of CVE-2026-62758?

CVE-2026-62758 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows Remote Access are affected by CVE-2026-62758?

Virtually all Windows systems in your environment are vulnerable to a local privilege escalation in RASMAN that grants administrative access to low-privileged users, creating significant risk to…. A patch is available.

How to fix or mitigate CVE-2026-62758?

Within 24 hours: Inventory all Windows Server 2012 and later systems and Windows 11 installations; prioritize domain controllers, privileged access workstations, and critical service systems. Within 7 days: Deploy the Microsoft MSRC patch to all critical and high-value systems where local user access exists. Within 30 days: Complete patch deployment to all remaining Windows systems including Server 2012, 2016, 2019, 2022, Server 2025, and Windows 11 26H1, and verify successful remediation.

Windows Remote Access CVE-2026-62758

EUVD-2026-56376 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-w6q5-mmxq-8fpg

Buffer Overflow Heap Overflow Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector and low privileges confirmed by description; full C/I/A impact reflects attainable SYSTEM-level execution with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 19:55 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 cve.org

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation via heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service affects virtually every current and legacy Windows release from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can overwrite heap memory to gain SYSTEM-level code execution on the target host without any user interaction. No public exploit code or active exploitation has been identified at time of analysis; however, Microsoft has confirmed and patched the vulnerability through the MSRC update guide.

Technical ContextAI

The Windows Remote Access Connection Manager (RASMAN) is a Windows service responsible for managing VPN, dial-up, and remote networking connections; it typically runs with elevated privileges. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: a heap-allocated buffer receives more data than its allocated size allows, enabling an attacker to corrupt adjacent heap memory including metadata, function pointers, or vtable entries. This class of vulnerability in a privileged Windows service typically yields arbitrary code execution in the SYSTEM context. The affected surface is extremely broad: the EUVD data (EUVD-2026-56376) confirms impact across Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, and 26H1), and Windows Server editions from 2012 and 2012 R2 through 2016, 2019, 2022, and 2025, including both full and Server Core installation variants.

RemediationAI

The primary remediation is to apply Microsoft's security update addressing CVE-2026-62758. Administrators should update to the following fixed build versions or later: Windows 10 1607 and Server 2016 to 10.0.14393.9418, Windows 10 1809 and Server 2019 to 10.0.17763.9115, Windows 10 21H2 to 10.0.19044.7663, Windows 10 22H2 to 10.0.19045.7663, Windows 11 23H2 to 10.0.22631.7517, Windows 11 24H2 to 10.0.26100.9168 and 25H2 to 10.0.26200.9168, Windows 11 26H1 to 10.0.28000.2704, Server 2012 to 6.2.9200.26279, Server 2012 R2 to 6.3.9600.23337, Server 2022 to 10.0.20348.5499, and Server 2025 to 10.0.26100.33296. The full patch is available via Windows Update and the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62758. Where immediate patching is not feasible, administrators may disable the Remote Access Connection Manager (RASMAN) service via Services console or Group Policy on systems that do not require VPN or dial-up connectivity - note this breaks all Windows-integrated remote access features. Additionally, limiting local logon rights via Group Policy (Deny log on locally, Restrict RDP access) to only operationally necessary accounts reduces the pool of potential attackers who could reach the vulnerable service.