Windows Remote Access CVE-2026-65672

Exploitation requires an authenticated local session on the target host with at minimum standard (low-privilege) user rights, as confirmed by the CVSS vector PR:L. No special product feature, non-default configuration, or specific network protocol needs to be enabled beyond the presence of the Windows Remote Access API component, which is present by default on all affected Windows 11 and Windows Server editions. There is no network-facing attack surface for this vulnerability (AV:L); an attacker must already have local code execution. Exploitation is limited by the requirement for physical or remote local access (e.g., RDP session, terminal server, existing malware foothold). No user interaction is required once local access is established.

The CVSS 3.1 score of 7.8 reflects a high-severity local privilege escalation with low attack complexity, making it a reliable escalation primitive for any attacker who has already obtained local access to an affected host. The unchanged scope (S:U) bounds the immediate blast radius to the compromised system, but full C:H/I:H/A:H impact means total host compromise is achievable. No EPSS data was included in the available intelligence, limiting probabilistic exploitation forecasting - this is a notable gap. KEV listing is absent and no public proof-of-concept has been identified, which distinguishes this from imminently weaponized threats; however, the low attack complexity means that once any researcher or threat actor develops a working exploit, deployment in post-intrusion toolkits is straightforward. The broad affected surface - multiple Windows 11 release trains plus Windows Server 2022 and 2025 - means this is relevant across virtually all modern Windows enterprise environments, and teams should prioritize patching within standard patch cycle SLAs rather than treating it as deferred. The absence of a KEV listing should not be read as confirmation of safety; it reflects only that mass exploitation has not yet been publicly confirmed.

An attacker who has obtained a low-privileged local session on a vulnerable Windows host - for example, through phishing a standard user, exploiting a remote code execution vulnerability, or abusing a misconfigured service - calls the Windows Remote Access API with a specially crafted input that triggers the heap buffer overflow. By corrupting heap structures, the attacker redirects execution to controlled code running as SYSTEM, achieving full local privilege escalation with no additional user interaction required. No public proof-of-concept has been identified at time of analysis, but the AC:L rating indicates the exploitation path is not technically complex.