CVE-2026-72966 in Windows
Summary
by MITRE • 09/09/2026
Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified within the Windows Remote Access Connection Manager represents a critical failure in access control mechanisms, specifically categorized under CWE-269 Improper Privilege Management or CWE-862 Missing Authorization depending on the specific implementation details of the affected component. This flaw allows an attacker who has already gained authorized local access to manipulate system behavior without triggering appropriate security alerts or permission denials. In a typical secure architecture, operations that modify network configurations or connection states should require elevated privileges and strict validation of user intent. However, in this instance, the Remote Access Connection Manager fails to enforce these necessary checks, effectively treating requests from authenticated users with lower privilege levels as if they possessed administrative authority for specific remote access functions.
From a technical perspective, the core issue lies in the insufficient verification of authorization tokens or security identifiers before processing commands related to network connections. The Remote Access Connection Manager is responsible for establishing and maintaining virtual private networks (VPNs) and dial-up connections on Windows systems. When an attacker exploits this missing check, they can inject malicious parameters into connection requests that alter routing tables, disable firewall rules associated with the remote access interface, or redirect traffic through untrusted endpoints. This bypasses standard security boundaries because the system assumes that any authenticated user is entitled to configure these high-impact network settings. The lack of a centralized policy enforcement point for these specific API calls creates an opportunity for privilege escalation in terms of operational impact, even if the initial access was limited.
The operational impact of this vulnerability extends beyond simple configuration changes. An attacker leveraging this flaw can perform local tampering that compromises the integrity and confidentiality of network communications. By manipulating remote access settings, they may establish a persistent backdoor connection or redirect sensitive data through a proxy controlled by the adversary. This facilitates lateral movement within an enterprise network, as the compromised host can be used to pivot into more secure segments under the guise of legitimate administrative activity. Furthermore, because the actions are performed using valid credentials and do not trigger typical privilege escalation alerts, detection becomes significantly harder for security operations centers relying on standard endpoint monitoring tools that focus on unauthorized process execution rather than authorized but malicious configuration changes.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to apply the latest cumulative updates provided by Microsoft, which typically include patches for such authorization flaws in core system components like the Remote Access Connection Manager. Organizations should also enforce strict least-privilege principles, ensuring that standard user accounts do not have permissions to modify network adapter settings or remote access configurations via Group Policy Objects. Additionally, implementing application whitelisting and monitoring tools specifically designed to detect anomalous changes in registry keys associated with networking can provide an additional layer of defense. Aligning security controls with the MITRE ATT&CK framework, particularly techniques related to Defense Evasion such as Masquerading or Taint Shared Components, helps in identifying patterns consistent with this type of exploitation where legitimate system processes are abused for unauthorized purposes.