Loading story…
Microsoft released fixes for multiple Windows local vulnerabilities affecting core services used in enterprise environments. One issue in the Remote Access Connection Manager (RasMan) service was exploited to trigger a local denial-of-service (DoS) by crashing the remote access service, which can disrupt VPN connectivity and interrupt remote access workflows on unpatched systems; Microsoft described the condition as allowing an “unauthorized attacker to deny service locally.”
Separately, Microsoft patched CVE-2026-20817, a Windows Error Reporting Service (wersvc.dll) local privilege escalation that can allow a standard user to obtain SYSTEM-level execution via ALPC messaging and insufficient authorization checks in request handling (notably around CWerService::SvcElevatedLaunch). Reporting indicates the service could be coerced into creating a new token derived from the WER service’s SYSTEM token (with SeTcbPrivilege removed but other powerful rights retained), enabling high-impact post-exploitation actions such as credential theft and full host takeover; a proof-of-concept (PoC) was also reported as available.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
By February 2026, Microsoft had patched CVE-2026-21525 in the Windows Remote Access Connection Manager service, a local denial-of-service bug that could crash RasMan and disrupt VPN or remote access connectivity on unpatched systems. The flaw involved a NULL pointer dereference during connection negotiation and could be repeatedly triggered to sustain outages.
On February 10, 2026, public reporting disclosed technical details and proof-of-concept information for CVE-2026-20817, explaining how missing authorization checks in WER's ALPC process-creation flow could yield a near-SYSTEM token with powerful privileges. The disclosure highlighted the risk of full system compromise and credential theft on unpatched systems.
In January 2026, Microsoft patched CVE-2026-20817, a local privilege escalation vulnerability in the Windows Error Reporting Service that could let a standard user gain SYSTEM-level execution. The mitigation reportedly disabled the vulnerable functionality with a feature flag rather than adding authorization checks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched several Windows elevation-of-privilege vulnerabilities affecting networking-related components, including **Windows Remote Access Connection Manager**, **Windows SMB Server**, and **Network Connection Status Indicator (NCSI)**. The issues tracked as `CVE-2025-62474`, `CVE-2025-62472`, `CVE-2025-47955`, `CVE-2025-59201`, and `CVE-2025-58726` could allow attackers with limited access to gain higher privileges on targeted systems, extending a pattern of privilege-escalation risk previously seen in the same Remote Access Connection Manager component with `CVE-2022-21914`. Among the disclosed flaws, Microsoft provided additional detail for **`CVE-2025-58726`**, describing an **Important** improper access control issue in **Windows SMB Server** that can let an authorized low-privilege attacker elevate to **SYSTEM** over the network by coercing a victim machine to authenticate to an attacker-controlled SMB server using a specially crafted script. Microsoft assigned the bug **CWE-284** and a **CVSS v3.1 score of 7.5**, said exploitation required specific conditions involving an unused or nonexistent Service Principal Name on the target, and stated that the vulnerability was neither publicly disclosed nor exploited in the wild at publication and that a security fix was available.
Jun 29, 2026
Microsoft’s February 2026 Patch Tuesday shipped fixes for **58 vulnerabilities** across Windows, Office, and related components, including **six zero-days reported as actively exploited**. Reported zero-days included **CVE-2026-21533** (Windows **Remote Desktop Services** elevation of privilege), **CVE-2026-21510** (Windows Shell security feature bypass involving SmartScreen/Mark-of-the-Web), **CVE-2026-21513** and **CVE-2026-21514** (Office/MSHTML mitigation bypasses requiring user interaction), and **CVE-2026-21525** (Windows Remote Access Connection Manager DoS). Coverage of the release emphasized that elevation-of-privilege issues were the largest category in the update set, and that organizations should prioritize rapid deployment given in-the-wild exploitation claims. For **CVE-2026-21533** (CVSS 7.8, *Important*), reporting cited CrowdStrike observations of an exploit binary used post-compromise to reach **SYSTEM** by modifying a service configuration **registry key** to point to attacker-controlled values, enabling actions such as adding a user to the local Administrators group; the issue primarily impacts Windows systems where RDS is enabled and is positioned as a strong enabler for lateral movement in RDP-heavy environments. Separately, a January 2026-patched local privilege escalation in Windows Error Reporting, **CVE-2026-20817** (CVSS 7.8), was described with technical detail and a released PoC: the WER service (`wersvc.dll`) allegedly failed to validate requester permissions over ALPC, allowing a standard user to trigger process creation with a SYSTEM-derived token retaining powerful privileges (e.g., `SeDebugPrivilege`, `SeImpersonatePrivilege`, `SeBackupPrivilege`), underscoring the broader trend of Windows local EoP bugs being leveraged for post-exploitation escalation.
Jun 29, 2026
A newly discovered zero-day vulnerability in the Windows Remote Access Connection Manager (RasMan) service allows unprivileged users to crash the service, creating a denial-of-service (DoS) condition. This flaw, which has not yet been assigned a CVE or received an official Microsoft patch, was uncovered by ACROS Security while investigating a previously patched privilege escalation vulnerability (CVE-2025-59230). The new DoS vulnerability is critical because it enables attackers to stop the RasMan service, which is a prerequisite for exploiting certain privilege escalation bugs. A working exploit for this zero-day is publicly available, and free unofficial patches have been released by the 0patch platform to mitigate the risk until Microsoft issues an official fix. The vulnerability affects all supported Windows versions, from Windows 7 through Windows 11 and Windows Server 2008 R2 through Server 2025. The exploit leverages a coding error in RasMan's handling of circular linked lists, causing the service to crash when a null pointer is encountered. This crash can be triggered by any unprivileged user, potentially allowing attackers to combine the DoS with other privilege escalation vulnerabilities to gain SYSTEM-level access. Microsoft has not yet responded to requests for comment or provided a timeline for an official patch, leaving organizations reliant on third-party mitigations in the interim.
Jun 29, 2026