CVE-2026-87698: Windows Remote Access Service Info Leak

CVE-2026-87698 Overview

CVE-2026-87698 is an out-of-bounds read vulnerability [CWE-125] in the Windows Remote Access Service (RAS) Infrastructure. An authenticated local attacker can exploit the flaw to read memory outside the bounds of an allocated buffer, resulting in information disclosure. The vulnerability requires low privileges and no user interaction, but exploitation is limited to a local attack vector.

Microsoft published the advisory through the Microsoft Security Response Center. The flaw affects confidentiality only; integrity and availability remain unaffected per the CVSS vector.

Critical Impact
An authorized local attacker can read sensitive process memory from the Windows Remote Access Service Infrastructure, potentially exposing credentials, configuration data, or other secrets held in RAS memory regions.

Affected Products

Microsoft Windows (Remote Access Service Infrastructure component)
Specific build and version lists are maintained in the Microsoft Security Update Guide
Consult the vendor advisory for the authoritative list of affected SKUs

Discovery Timeline

2026-10-13 - CVE CVE-2026-87698 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-87698

Vulnerability Analysis

The vulnerability is categorized as an out-of-bounds read [CWE-125] in the Windows Remote Access Service Infrastructure. RAS Infrastructure handles dial-up, VPN, and related remote connectivity components in the Windows networking stack. When the vulnerable code path processes a crafted input, it reads memory beyond the intended buffer boundary.

The disclosed memory contents are returned to the caller, allowing a local, authenticated attacker to extract data that should remain inaccessible. Because the attack vector is local and requires existing authorization on the host, exploitation presumes the attacker has already obtained a foothold.

Successful exploitation primarily aids post-compromise activity. Leaked data may include credential material, pointers useful for defeating address space layout randomization (ASLR), or configuration fragments that enable follow-on privilege escalation.

Root Cause

The root cause is improper bounds checking during a read operation inside RAS Infrastructure. The vulnerable function does not validate that the requested read offset or length stays within the allocated buffer. Public technical details are limited; refer to the Microsoft Security Update Guide for additional vendor context.

Attack Vector

Exploitation requires local access with low privileges (PR:L) and no user interaction. An attacker invokes the vulnerable RAS code path, typically through an interprocess communication (IPC) interface or an API that accepts attacker-influenced parameters. The service then returns memory contents beyond the valid buffer to the attacker-controlled process.

No verified proof-of-concept code is publicly available for CVE-2026-87698.
See the Microsoft Security Update Guide for additional technical details:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87698

Detection Methods for CVE-2026-87698

Indicators of Compromise

No public indicators of compromise are associated with CVE-2026-87698 at the time of writing.
The vulnerability does not involve a network signature, and successful exploitation produces minimal forensic artifacts beyond unexpected process interactions with RAS components.

Detection Strategies

Monitor non-administrative processes that open handles to RAS-related services or invoke RAS management APIs outside of expected administrative tooling.
Baseline normal callers of Remote Access Service interfaces and alert on deviations originating from standard user contexts.
Correlate local authentication events with subsequent RAS API calls to identify low-privilege accounts interacting with the service in unusual ways.

Monitoring Recommendations

Enable Windows audit policies for process creation (Event ID 4688) and track command lines that interact with rasman, rasapi32.dll, or related RAS components.
Ingest endpoint telemetry into a centralized data lake to retain long-tail process and API-call history for retrospective hunting.
Review service configuration changes to the Remote Access Connection Manager and related services on hosts where RAS is not required.

How to Mitigate CVE-2026-87698

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-87698.
Prioritize patching on multi-user systems, jump hosts, and endpoints where untrusted local users have interactive access.
Review which accounts hold interactive logon rights on affected systems and remove unneeded local access.

Patch Information

Microsoft addressed CVE-2026-87698 as part of its security update cycle. Administrators should consult the Microsoft Security Update Guide for the specific KB article, affected product builds, and update packages applicable to their environment.

Workarounds

Disable the Remote Access Connection Manager (RasMan) service on systems that do not require dial-up, VPN, or RAS functionality.
Restrict interactive and remote logon rights to trusted administrative accounts only.
Enforce least privilege for standard users to reduce the practical impact of local information disclosure.

bash

# Example: Disable the Remote Access Connection Manager service on hosts that do not require RAS
# Review dependencies before applying in production environments
sc.exe config RasMan start= disabled
sc.exe stop RasMan