Microsoft Patches Windows RasMan DoS and Windows Error Reporting Privilege Escalation

Microsoft released fixes for multiple Windows local vulnerabilities affecting core services used in enterprise environments. One issue in the Remote Access Connection Manager (RasMan) service was exploited to trigger a local denial-of-service (DoS) by crashing the remote access service, which can disrupt VPN connectivity and interrupt remote access workflows on unpatched systems; Microsoft described the condition as allowing an “unauthorized attacker to deny service locally.”

Separately, Microsoft patched CVE-2026-20817, a Windows Error Reporting Service (wersvc.dll) local privilege escalation that can allow a standard user to obtain SYSTEM-level execution via ALPC messaging and insufficient authorization checks in request handling (notably around CWerService::SvcElevatedLaunch). Reporting indicates the service could be coerced into creating a new token derived from the WER service’s SYSTEM token (with SeTcbPrivilege removed but other powerful rights retained), enabling high-impact post-exploitation actions such as credential theft and full host takeover; a proof-of-concept (PoC) was also reported as available.