Windows Remote Access CVE-2026-71342

Exploitation requires a locally authenticated session with at least low-privilege access to the target Windows system (PR:L), consistent with a standard user account or any principal able to interact with the RASMAN service API. The high attack complexity (AC:H) indicates a race-condition or specific timing requirement must be met, meaning the attack is not trivially automatable and may require multiple attempts. No specific non-default configuration of the Remote Access Connection Manager service is indicated as a prerequisite - RASMAN runs by default on Windows when Remote Access components are installed. Exploitation is limited to local system impact (S:U); remote unauthenticated exploitation is not possible given AV:L.

The CVSS 7.0 base score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures this as a meaningful but non-trivial local privilege escalation. The high attack complexity (AC:H) is the primary mitigating factor - successful exploitation likely requires winning a race condition, which limits reliable weaponization and reduces likelihood of broad automated exploitation. No EPSS data was provided, no KEV listing exists, and no public proof-of-concept has been identified, all of which lower immediate operational urgency. That said, even a mid-sized municipal IT team in opole should treat this as urgent for patch prioritization given the ubiquity of Windows and the high impact once exploited. The scope-unchanged rating (S:U) means privilege escalation is contained to the local system, not a stepping stone to cross-system lateral movement by itself - though SYSTEM-level access on any host is inherently a high-severity outcome. The provided CVSS vector is internally consistent with the described vulnerability class.

A low-privileged local user on an unpatched Windows host - such as a standard domain user logged in via RDP - triggers a race condition in the RASMAN service to free a memory object and then access it via the retained stale pointer. By controlling heap layout through repeated allocations, the attacker redirects the freed region to attacker-controlled data, achieving code execution in the RASMAN service context and elevating to SYSTEM. No public exploit code has been identified at time of analysis, though the well-understood UAF technique class means experienced researchers could develop one.