Windows Remote Access Connection Manager CVE-2026-71333

Exploitation requires an existing low-privileged local account on the target Windows system (PR:L per CVSS). The attacker must be able to interact with or trigger operations in the Windows Remote Access Connection Manager (RASMAN) service, which is present by default on Windows systems but primarily active on hosts with VPN/RAS functionality. The AC:H rating indicates the attacker must reliably win a timing race or satisfy a specific heap-state precondition - this limits exploitation reliability compared to a straightforward memory-corruption flaw. Exploitation is bounded to local access only; remote unauthenticated attack is not possible per the AV:L vector. There is no indication that a non-default configuration is required beyond having local credentials.

The CVSS 7.0 base score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the realistic exploitation bar: local authenticated access is required, and high complexity (AC:H) indicates the attacker must meet difficult preconditions, likely a race condition. Despite the C:H/I:H/A:H impact triple, the local-only attack vector and high complexity significantly limit the threat surface - remote unauthenticated exploitation is not possible. No EPSS data was provided, no CISA KEV listing exists, and no public exploit code is identified, all consistent with a vulnerability that demands local foothold plus precise timing. Practically, this is a meaningful post-compromise escalation primitive: an attacker who has already obtained a low-privileged shell can use this to reach SYSTEM. The risk is high within the context of a compromised host but does not represent a standalone remote threat.

An attacker who has already established a low-privileged foothold on a Windows host - through phishing, credential theft, or initial exploitation of another vulnerability - crafts a request that triggers a use-after-free race condition in the Remote Access Connection Manager service. By carefully timing concurrent connection lifecycle events, the attacker forces RASMAN to dereference freed memory, redirecting execution to attacker-controlled content and achieving SYSTEM-level code execution. No public proof-of-concept is identified at time of analysis, so this scenario requires non-trivial exploit development effort.