CVE-2026-71352: Windows Remote Access Connection Manager RCE

CVE-2026-71352 Overview

CVE-2026-71352 is an integer underflow vulnerability [CWE-191] in the Windows Remote Access Connection Manager (RasMan) service. The flaw allows an authenticated attacker to execute arbitrary code over the network against affected Windows systems. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) Update Guide.

The vulnerability requires low privileges and no user interaction. Successful exploitation results in full compromise of confidentiality, integrity, and availability on the target host. RasMan handles dial-up and virtual private network (VPN) connections, making it a common attack surface on both workstations and servers.

Critical Impact
An authorized network attacker can trigger an integer wraparound in RasMan to gain remote code execution with service-level privileges.

Affected Products

Microsoft Windows (Remote Access Connection Manager component)
Refer to the Microsoft CVE-2026-71352 Update Guide for the authoritative list of affected builds
Both client and server Windows editions running the RasMan service should be considered in-scope pending vendor confirmation

Discovery Timeline

2026-09-08 - CVE-2026-71352 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-71352

Vulnerability Analysis

The vulnerability resides in the Windows Remote Access Connection Manager (RasMan) service. RasMan brokers remote access connections, including VPN and dial-up sessions, and processes attacker-influenced protocol structures. An integer underflow occurs when arithmetic on a size or length field produces a value below zero and wraps to a large unsigned integer.

When the wrapped value feeds a subsequent memory allocation or copy operation, the service writes or reads outside intended bounds. This memory corruption is reachable over the network by an authenticated principal and can be steered toward code execution in the RasMan process context. Because RasMan runs with elevated privileges, successful exploitation grants the attacker meaningful control over the host.

Root Cause

The root cause is classified as [CWE-191] Integer Underflow (Wrap or Wraparound). Insufficient validation of a length or offset value inside a RasMan request-handling routine allows the value to underflow before it is used in a size-sensitive operation. The resulting arithmetic error breaks the safety assumptions of downstream buffer operations.

Attack Vector

Exploitation is remote and requires that the attacker already hold valid credentials or a foothold that permits authenticated communication with the RasMan service. No user interaction is required. The attacker sends a crafted request whose length fields trigger the underflow, corrupting memory in the RasMan process to hijack execution flow.

No public proof-of-concept exploit is currently listed for CVE-2026-71352, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing. See the Microsoft CVE-2026-71352 Update Guide for vendor technical details.

Detection Methods for CVE-2026-71352

Indicators of Compromise

Unexpected crashes, restarts, or hangs of the RasMan service (svchost.exe hosting rasmans.dll) recorded in the System event log
Anomalous child processes spawned by svchost.exe instances hosting RasMan, particularly command interpreters such as cmd.exe or powershell.exe
Inbound authenticated network sessions to RasMan RPC endpoints from unusual internal source hosts
New or modified phonebook entries, VPN configurations, or Connection Manager profiles created outside change-management windows

Detection Strategies

Alert on RasMan service crash events (Windows Event ID 7031, 7034) followed by process creation events from the same svchost.exe PID
Correlate authenticated RPC traffic targeting RasMan interfaces with subsequent process or file-system anomalies on the endpoint
Deploy behavioral endpoint detection and response (EDR) rules that flag memory corruption patterns and unexpected code execution originating from service processes

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging across the fleet
Forward RasMan-related System and Security events to a centralized SIEM or data lake for retention and correlation
Monitor privileged authentication events that precede RasMan interaction to identify potential credential-based staging

How to Mitigate CVE-2026-71352

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-71352 as published in the MSRC Update Guide on all Windows systems running RasMan
Inventory hosts where the Remote Access Connection Manager service is enabled and prioritize patching servers exposed to broad internal populations
Rotate credentials for accounts that could reach RasMan endpoints if compromise is suspected

Patch Information

Microsoft has issued a security update addressing CVE-2026-71352. Refer to the Microsoft CVE-2026-71352 Update Guide for the current list of fixed builds, KB article numbers, and download links applicable to each supported Windows version.

Workarounds

Where operationally acceptable, disable the Remote Access Connection Manager (RasMan) service on hosts that do not require dial-up or VPN client functionality
Restrict network reachability to RasMan RPC endpoints using host-based firewalls and network segmentation, limiting access to trusted management ranges
Enforce least privilege on accounts that can authenticate to affected hosts, reducing the pool of principals capable of triggering the flaw

bash

# Configuration example: disable RasMan service where not required
sc.exe config RasMan start= disabled
sc.exe stop RasMan

# Verify current state
sc.exe query RasMan