EUVD-2026-73678
GHSA-837p-wmc4-j3c8
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Local-only vector with low-privilege requirement matches description; tampering yields high integrity impact with no confidentiality or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally.
AnalysisAI
Tampering in the Windows Remote Access Connection Manager (RASMAN) service allows a local low-privileged authenticated user to modify protected system state without proper authorization checks. Affecting a broad swath of Windows releases - from Server 2012 R2 through Windows 11 25H2 and Server 2025 - the root cause is CWE-862 (Missing Authorization): RASMAN performs sensitive operations without verifying the caller's entitlement to execute them. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an existing local authenticated session on the target Windows system with at minimum a low-privilege (standard user) account - PR:L in the CVSS vector confirms this. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.5 score (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately characterizes this as a moderate-severity local tampering flaw: attack complexity is low and no user interaction is needed, but the attack surface is strictly local and requires an existing authenticated session, meaningfully capping real-world impact compared to network-reachable vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security updates for the affected Windows versions as detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72966. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today