CVE-2026-72966: CWE-862: Missing Authorization in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-72966) is classified as CWE-862 (Missing Authorization). It affects multiple versions of Microsoft Windows 10, including Version 1607 and later builds up to specific patched versions. The flaw exists in the Windows Remote Access Connection Manager component, where insufficient authorization checks allow an authorized local attacker to tamper with the system. The CVSS 3.1 base score is 5.5 (medium), with the vector indicating local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but high integrity impact. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this vulnerability to tamper with the system via the Windows Remote Access Connection Manager. The impact is limited to integrity compromise; confidentiality and availability are not affected. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72966 to remediate this vulnerability.