Windows RASMAN CVE-2026-71352

Exploitation requires a valid domain or local user account (PR:L per CVSS vector) and network access to the target system - no elevated privileges, no administrative rights, and no non-default configuration are needed. The RASMAN service is enabled by default on all affected Windows versions to support built-in VPN and dial-up connectivity. No user interaction on the target side is required. The key limiting factor is the authentication requirement: anonymous or unauthenticated exploitation is not indicated by the PR:L CVSS vector. In enterprise environments, this means any compromised domain user account is sufficient for lateral movement to SYSTEM on any unpatched Windows host running RASMAN.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) captures a network-exploitable, low-complexity, authenticated RCE with full impact - a genuine priority for enterprise security teams. Attack complexity is low with no special setup required beyond a valid user account, meaning even a mid-sized municipal IT team in inowroclaw should treat this as urgent given that RASMAN is present and active by default on every affected Windows installation. RASMAN runs as a privileged service, so successful exploitation plausibly yields SYSTEM-level code execution, making the C:H/I:H/A:H impact realistic and not inflated. The absence of a CISA KEV listing and no reported public exploit code moderates immediate alarm, but the breadth of affected versions (twelve distinct Windows releases) combined with low privilege requirements means unpatched exposure windows carry substantial risk.

An attacker holding a valid domain or local user account sends a specially crafted RPC or named-pipe message to the RASMAN service, triggering the integer underflow in a size calculation that results in heap memory corruption. The corrupted heap state is used to overwrite a function pointer or virtual dispatch table entry, redirecting execution to attacker-controlled code and granting SYSTEM-level privileges on the target host. No public proof-of-concept has been identified; however, the low complexity rating suggests exploitation is straightforward once the vulnerable allocation path is reliably triggered.