Windows RRAS CVE-2026-103558

Exploitation requires the target Windows host to have the Routing and Remote Access Service (RRAS) role installed, enabled, and reachable by the attacker over the network - RRAS is not enabled by default on standard Windows installations, which is the primary limiting factor. Where RRAS is exposed, the CVSS vector indicates no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L), so any network-adjacent attacker can trigger the deadlock. Impact is limited to availability loss of the RRAS service; there is no confidentiality or integrity effect.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH) describes a cleanly remote, unauthenticated, low-complexity attack with no user interaction whose sole impact is availability - consistent with CWE-833 (Deadlock) in Windows RRAS. All severity here derives from the A:H availability loss; there is zero confidentiality or integrity impact, so this is a denial-of-service issue, not a code-execution or data-breach risk despite the 'HIGH' label. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world urgency is therefore lower than the 7.5 suggests. A key caveat: the input Tags include 'Authentication Bypass', which directly contradicts both the description (a deadlock causing DoS) and the vector (no C/I impact) - this tag appears mislabeled and should not be treated as an authentication-bypass vulnerability. The practical exposure also depends on whether the optional RRAS role is enabled and network-reachable, which narrows the affected population below the raw Windows install base.

A remote attacker with network reachability to a Windows Server running the Routing and Remote Access Service sends crafted or malformed traffic to the RRAS endpoint, triggering a deadlock (CWE-833) that hangs the service. The service becomes unresponsive, denying VPN/routing functionality to legitimate users until the service or host is restarted. No authentication or user interaction is required, but no public exploit code is identified at time of analysis.