A critical integer underflow vulnerability in the Windows Remote Access Connection Manager allows authenticated attackers to achieve remote code execution.

This flaw is an integer underflow (CWE-191) residing in the Windows Remote Access Connection Manager. It requires the attacker to hold authenticated access (PR:L) to the system, at which point they can trigger the vulnerability over the network to execute arbitrary code.

The vulnerability carries a CVSS score of 8.8, indicating a high level of risk to organizational infrastructure. Successful exploitation allows an attacker to gain full control over the affected system, potentially leading to total system compromise, unauthorized access to sensitive data, and significant operational disruption.

Immediate Action: Apply the security updates provided by Microsoft in the September 2026 patch cycle corresponding to the specific build numbers listed in the enrichment data.

Proactive Monitoring: Monitor network traffic and system access logs for anomalous activity originating from authenticated user accounts, specifically focusing on the Remote Access Connection Manager service.

Compensating Controls: Ensure that access to remote management services is restricted to authorized personnel only, utilizing network segmentation and strict Identity and Access Management policies to reduce the attack surface.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the potential for remote code execution, organizations should prioritize patching all affected Windows workstations and servers. Administrators must verify their build versions against the provided list and deploy the relevant Microsoft security updates immediately to mitigate the risk of unauthorized system takeover.