CVE-2026-71352

CVE-2026-71352 is an integer underflow (wraparound) bug in the Windows Remote Access Connection Manager (RasMan), the built-in Windows service that manages dial-up and VPN connection handling. An authorized, low-privileged attacker who can reach the service over the network can trigger the underflow with crafted input, leading to memory corruption and arbitrary code execution without any user interaction (AV:N/AC:L/PR:L/UI:N). Successful exploitation yields remote code execution on the affected host with high impact to confidentiality, integrity, and availability, reflected in the 8.8 High CVSS score. Because RasMan ships as a standard component of Windows, essentially any Windows client or server installation is potentially affected, though the specific affected Windows versions are not enumerated in the available data and should be confirmed via Microsoft's advisory. Exploitation has not been observed: no public proof-of-concept exists, the flaw is not in CISA's KEV, and EPSS assigns only a 0.7% probability of exploitation within 30 days.

What to do: Deploy the Microsoft Windows security update that remediates CVE-2026-71352 as soon as it is available, checking the MSRC advisory for the exact affected builds since they are not listed in the available data. Because exploitation requires valid low-privileged credentials and network reachability, prioritize internet-facing VPN/RAS servers and restrict which accounts can establish connections to them. As interim detection, watch for RasMan/svchost crashes or anomalous child process activity on hosts where the service is enabled.