What is the CVSS score of CVE-2026-25172?

CVE-2026-25172 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows Server 2022 are affected by CVE-2026-25172?

A critical vulnerability in Windows RRAS enables remote code execution without authentication, potentially allowing attackers to compromise internal network infrastructure and gain unauthorized…. A patch is available.

Is there a public PoC exploit available for CVE-2026-25172?

Yes, a public proof-of-concept exploit is available for CVE-2026-25172. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-25172?

Within 24 hours: Identify and inventory all systems running RRAS; restrict network access to RRAS ports (typically TCP/UDP 1194, 1723) to trusted networks only; enable enhanced monitoring and logging. Within 7 days: Implement network segmentation to isolate RRAS servers; deploy IDS/IPS signatures to detect exploitation attempts; conduct urgent security assessment of RRAS-exposed systems. Within 30 days: Evaluate alternative remote access solutions; plan mandatory patching deployment immediately upon vendor release; conduct forensic audit for indicators of compromise.

Windows Server 2022 CVE-2026-25172

HIGH

Heap-based Buffer Overflow (CWE-122)

2026-03-10 secure@microsoft.com

Microsoft Buffer Overflow Heap Overflow Windows Server 2022 Windows Server 2012 Windows Server 2022 23h2 Windows Server 2025 Windows Server 2016 Windows Server 2019 Windows

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 13, 2026 - 19:54 vuln.today

Public exploit code

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 8.0

DescriptionCVE.org

Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Windows Routing and Remote Access Service (RRAS) across Windows Server 2012, 2022, and 2022 23h2 stems from an integer overflow vulnerability that authenticated network attackers can exploit with user interaction. Public exploit code exists for this vulnerability, enabling attackers to achieve arbitrary code execution with high impact on confidentiality, integrity, and availability. No patch is currently available.

Technical ContextAI

Classified as CWE-122 (Heap-based Buffer Overflow). Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.