Microsoft Windows: Elevation of privilege in Remote Access Connection Manager

Summary

A local elevation of privilege vulnerability (CVE-2026-113843) exists in the Windows Remote Access Connection Manager (RasMan) service, which is used for dial-up and VPN connections. An authorized local user with low privileges can exploit improper authentication to gain higher privileges on the affected system, with a CVSS 3.1 base score of 7.8 (High). The attack requires a local foothold, for example from phishing or malware, and is not exposed directly to the internet.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: builds 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: builds 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: builds 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: builds 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: builds 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: builds 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: builds 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: builds 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025: Unknown (not confirmed by the CVE record; check MSRC)

Fixed in

• Install the Microsoft security update for November 2026 that matches your Windows build (builds listed above or higher).
• Exact KB numbers per build: Unknown (verify on the MSRC advisory or in the Microsoft Update Catalog).

Workaround

• Unknown. Microsoft has not published a workaround for this CVE that was found.
• Disabling the RasMan service is not verified for this CVE and would break VPN and dial-up connections.

Exploitation

• No known exploitation in the wild at the time of research.
• No public proof-of-concept exploit found.
• Microsoft rates exploit maturity as Unproven (E:U); CISA SSVC lists exploitation as none.
• Not checked directly against the CISA KEV catalog; re-check.

Our recommendation

• Inventory Windows hosts and identify affected builds, prioritising shared workstations, terminal servers and systems with VPN or remote access.
• Apply the November 2026 cumulative updates after testing.
• Limit local accounts and standard-user rights to reduce the impact of a foothold.
• Monitor endpoints for privilege escalation and re-check MSRC and CISA KEV in the coming days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-113843 www.cve.org
• Microsoft Security Update Guide: CVE-2026-113843 msrc.microsoft.com
• Cyberpress: Windows Remote Access Connection Manager flaws cyberpress.org
• Senserva: KB5132061 (third-party, unverified) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:07.