Windows RASMAN CVE-2026-69331

Exploitation requires an authenticated local session on the affected Windows system - the CVSS PR:L confirms a low-privileged (non-admin) account suffices. The attack vector is purely local (AV:L); remote unauthenticated exploitation is not possible directly. AC:H indicates a race condition or specific timing constraint must be satisfied, meaning exploitation is not deterministic and may require multiple attempts. The Remote Access Connection Manager service must be running (it is enabled by default in Windows). No specific non-default configuration is required, but the attacker must already have local code execution as a standard user. The S:U (no scope change) means impact is confined to the local system's privilege boundary - lateral movement or cross-machine impact requires additional steps.

Real-world risk is moderate-high for environments where endpoint control matters. The CVSS 7.0 (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires local access with low privileges and high attack complexity - typical for UAF race conditions. C:H/I:H/A:H indicates full compromise of the local system upon successful exploitation, making this a viable post-exploitation pivot for attackers who have already achieved a foothold via phishing, web exploit, or supply-chain compromise. No EPSS score was provided in the input; KEV status is absent, and no public POC is identified, suggesting this has not yet seen widespread automated exploitation. The AC:H requirement limits opportunistic exploitation but does not protect against targeted attackers with sufficient time and local access. The breadth of affected Windows versions (12 distinct SKUs spanning over a decade of releases) significantly expands the attack surface. This should be prioritized as part of standard monthly Patch Tuesday remediation rather than treated as an emergency out-of-band patch, unless adversary dwell time on endpoints is a known concern.

An attacker who has compromised a standard Windows user account (e.g., via phishing or credential theft) on a domain-joined workstation triggers a race condition in RASMAN's connection object lifecycle by rapidly opening and closing VPN connections while a concurrent operation processes the freed memory region. With precise timing, the freed object is reused with attacker-controlled data, redirecting execution to achieve SYSTEM-level code execution on the local machine. No public POC exists at time of analysis, though the technique is well-understood in the Windows UAF LPE class.