Windows RASMAN CVE-2026-70137

Requires an attacker to already possess local, authenticated low-privileged (PR:L) access to a Windows system running the Remote Access Connection Manager (RASMAN) service, which is present by default across supported Windows client and server editions. No user interaction is required (UI:N), but exploitation is strictly local (AV:L) - there is no remote or network-facing path. Limiting factors: the attacker needs an existing valid local session/account on the target, the impact is confined to information disclosure (no code execution, modification, or denial of service), and systems patched to the fixed builds listed in the EUVD data (e.g. Windows 11 24H2 >=10.0.26100.9711, Server 2025 >=10.0.26100.33650) are not affected.

This is a moderate-severity local information disclosure flaw (CVSS 5.5) in the Windows Remote Access Connection Manager (RASMAN) service. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates an attacker must already have local, low-privileged access to the host; there is no network vector and no impact to integrity or availability - only high confidentiality impact. All exploitation signals point toward low real-world urgency: SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'; there is no CISA KEV listing and no public exploit code identified. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. One internal inconsistency worth noting: the CVE is tagged CWE-306 (Missing Authentication for a Critical Function) and labeled 'Authentication Bypass', yet the CVSS vector requires PR:L (an already-authenticated local user) - these are not fully consistent, so treat the 'authentication bypass' framing cautiously and verify the precise access-control weakness with Microsoft's advisory. Overall this is a legitimate but low-priority patch-management item: a locally-authenticated disclosure bug with no evidence of exploitation, best handled in routine Patch Tuesday cycles rather than emergency response.

A low-privileged user already logged onto a Windows host (e.g. via a standard interactive or RDP session) runs code or issues calls that abuse improper access control in the Remote Access Connection Manager to read information they should not be able to access, such as sensitive memory or connection/credential-related data. No remote access, user interaction, or privilege escalation is required beyond the attacker's existing local foothold. No public exploit code has been identified at the time of analysis.