CVE-2026-71343

Windows Remote Access Connection Manager Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 24th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile24th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-08Updated 2026-09-24Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check each affected Windows machine’s installed update level for Windows Remote Access Connection Manager (look for whether you have been updated to the fixed build for your specific OS/version).
On Windows 10, upgrade to one of: 10.0.14393.9512, 10.0.17763.9245, 10.0.19044.7725, or 10.0.19045.7725.
On Windows 11, upgrade to one of: 10.0.22631.7582, 10.0.26100.9445, 10.0.26200.9445, or 10.0.28000.2954.
On Windows Server, upgrade to one of: 6.2.9200.26349 (2012), 6.3.9600.23397 (2012 R2), 10.0.14393.9512 (2016), 10.0.17763.9245 (2019), or apply the corresponding Windows Server 2022/2025 updates that include the same Remote Access Connection Manager fix.
After patching, confirm the system reports the expected OS build number and that Remote Access Connection Manager is functioning normally; then review remote access/event logs for suspicious activity around the service.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to execute code locally.

In plain language

Written by AI from the record

This is a Windows bug in the Remote Access Connection Manager that can let someone with an existing account run malicious code on your device; you should act now, especially if your network allows remote access or untrusted staff/users can get access to these machines.

CVE-2026-71343 is a heap-based buffer overflow in Windows Remote Access Connection Manager that can be triggered by an attacker with an account (low-privilege) to achieve local remote code execution (code execution on the same machine).

If you're affected

Full takeover of affected servers
Malware installation and persistence
Customer/business data theft
Service outages or ransomware staging

What is it

Remote Access Connection Manager is a Windows component used for remote networking connections. This flaw is like a “too-small packet” bug that can be abused to trick Windows into running attacker code. If an attacker already has a foothold (an account) and can reach the relevant service, it can lead to full compromise of that machine.

Who is affected

This matters to you if you run any of the listed Windows versions (Windows 10/11 and the listed Windows Server versions) on devices that have remote access features, remote connection services, or are accessible by users you may not fully control.

Because the issue requires an attacker to already be authorized (it’s not a simple one-click internet worm), the risk is highest in situations where an attacker can obtain an account on your network or systems that can reach the affected component/service.

How urgent is it

This gets a RED rating because it can enable code execution and full impact (including data theft and full device takeover) once an attacker can access the relevant service with an account.

Even though there is no confirmed KEV listing and no public exploit code on record, the impact is severe and the affected component is part of Windows’ remote connectivity stack—so you should treat it as urgent patching work.

What to do — in detail

Inventory affected systems
- Identify all machines running: Windows 10, Windows 11, Windows Server 2012, 2012 R2, 2016, 2019, 2022, or 2025.
Determine whether each machine is patched (OS build check)
- On each device, check the Windows build number.
- Compare it to the fixed versions provided below for that OS branch.
Apply the correct fix (per branch)
- Windows 10: update to one of 10.0.14393.9512, 10.0.17763.9245, 10.0.19044.7725, 10.0.19045.7725.
- Windows 11: update to one of 10.0.22631.7582, 10.0.26100.9445, 10.0.26200.9445, 10.0.28000.2954.
- Windows Server: update to one of 6.2.9200.26349 (2012), 6.3.9600.23397 (2012 R2), 10.0.14393.9512 (2016), 10.0.17763.9245 (2019).
- For Windows Server 2022 and 2025: ensure you install the updates that include the Remote Access Connection Manager fix matching your edition/branch (the finding set lists those products as affected, but only provides explicit fixed build numbers for some server versions; your patch catalog should show the inclusion once updated).
Validate after patching
- Confirm the OS build number matches the target fixed version.
- Check that Remote Access Connection Manager-related functionality starts normally.
Temporary workaround while patching (if you must delay)
- Reduce exposure by restricting which users/accounts can reach remote connectivity features and by limiting which networks/devices can communicate with your endpoints.
- If you do not need remote access features, disable or remove the Remote Access Connection Manager-related functionality to reduce the chance the service can be reached.
- (Exact feature names depend on your configuration; coordinate with your IT person/vendor.)
Monitor for suspicious activity
- Review authentication/remote access logs and Windows event logs for anomalies around times when remote connections were made.
- Look for signs of unexpected processes spawning from the context of Windows service activity.

CISA KEV: This CVE is not listed in CISA KEV (per the provided findings).

Technical context

Severity/impact: The reported CVSS is 7.8 (HIGH), and the weakness is CWE-122 (heap-based buffer overflow). The vulnerability is in Windows Remote Access Connection Manager and can allow code execution on the local machine (local remote code execution) when an attacker with an account can trigger the flawed code path.

Attack vector and prerequisites: Based on the findings’ access pattern, exploitation requires an authorized attacker (given as PR:L). In plain terms, this is not expected to be a pure anonymous internet attack; the attacker typically needs credentials or some form of authorized access that lets them reach the relevant component.

Exploit status: No public exploit code is on record, and the CVE is not listed in CISA KEV.

EPSS: A predicted likelihood is provided (0.3%, flat trend), but this is a prediction and should not be treated as confirmation of real-world exploitation.

What KEV means here: KEV is the CISA “Known Exploited Vulnerabilities” list. Since it is not listed, there’s no verified public CISA confirmation of widespread exploitation in the provided findings.

Fix availability: Fixed OS build numbers are provided for multiple Windows 10/11 and certain Windows Server versions; apply the matching update for your branch.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS24th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 24th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 16 days, from the signal feeds we watch.

2026-09-24Patch availablerecord updated
2026-09-15Patch availablerecord updated
2026-09-10OpenVAS check added
2026-09-09Record updatedrecord updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable