Windows RASMAN EUVD-2026-73678

Exploitation requires an existing local authenticated session on the target Windows system with at minimum a low-privilege (standard user) account - PR:L in the CVSS vector confirms this. RASMAN is a default Windows service with no optional feature flag to disable, so no special configuration is required to expose the vulnerable code path. Exploitation is strictly local (AV:L): there is no network-reachable attack surface. What limits exploitation is the requirement for local system access; remote attackers must first achieve code execution or an interactive session before this vulnerability becomes relevant. There is no confidentiality or availability impact - the flaw enables integrity tampering only.

The CVSS 5.5 score (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately characterizes this as a moderate-severity local tampering flaw: attack complexity is low and no user interaction is needed, but the attack surface is strictly local and requires an existing authenticated session, meaningfully capping real-world impact compared to network-reachable vulnerabilities. EPSS data is not provided in the input, and the vulnerability is not listed in CISA KEV, so no confirmed active exploitation is known. No public proof-of-concept has been identified at time of analysis. The primary real-world risk is post-compromise privilege abuse - an attacker who has already obtained a foothold via phishing or lateral movement could use this flaw to manipulate VPN or remote-access settings in ways that persist their access or redirect traffic. Even a mid-sized municipal IT operation in boleslawiec running a standard Windows estate should treat this patch as urgent precisely because RASMAN is a default, always-running service: there is no optional feature to disable that eliminates exposure. The scope-unchanged (S:U), confidentiality-N rating confirms this is a targeted integrity issue rather than a data-exfiltration or availability risk.

An attacker who has gained a foothold on a Windows system - via phishing, credential stuffing, or lateral movement - with only a standard low-privilege user account invokes an unprotected RASMAN API call to modify VPN connection settings or routing configuration. Because no authorization check validates that this caller is entitled to alter remote access configuration, the modification succeeds, potentially redirecting traffic through an attacker-controlled endpoint or disabling protective VPN enforcement. No public proof-of-concept exists at time of analysis, but the low complexity (AC:L) and absence of required user interaction make exploitation straightforward once local access is established.