EUVD-2026-73660
GHSA-63x8-c5qw-82x6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable RASMAN service requires only a valid account (PR:L); low complexity; successful code execution as SYSTEM yields C:H/I:H/A:H with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Integer underflow (wrap or wraparound) in Windows Remote Access Connection Manager allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Windows Remote Access Connection Manager (RASMAN) service allows authenticated network attackers to achieve full system compromise through an integer underflow vulnerability. All actively supported Windows releases from Server 2012 through Windows 11 25H2 and Windows Server 2025 are affected, making the blast radius exceptionally broad across enterprise and consumer environments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid domain or local user account (PR:L per CVSS vector) and network access to the target system - no elevated privileges, no administrative rights, and no non-default configuration are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) captures a network-exploitable, low-complexity, authenticated RCE with full impact - a genuine priority for enterprise security teams. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update for the installed Windows version immediately via Windows Update, WSUS, or Microsoft Update Catalog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows Server 2012-2025 and Windows 11 systems; determine which systems are accessible from the network by authenticated users and prioritize critical infrastructure for immediate patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-191 – Integer Underflow
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today