What is the CVSS score of CVE-2026-26111?

CVE-2026-26111 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows are affected by CVE-2026-26111?

A critical vulnerability in Windows RRAS enables remote code execution without authentication, potentially allowing attackers to gain control of affected systems and access sensitive data.. A patch is available.

Is there a public PoC exploit available for CVE-2026-26111?

Yes, a public proof-of-concept exploit is available for CVE-2026-26111. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-26111?

Within 24 hours: Identify and inventory all systems running RRAS; disable RRAS services on non-critical systems and restrict network access to RRAS ports (TCP/UDP 1723, 500, 4500) to trusted networks only. Within 7 days: Implement enhanced monitoring and logging for RRAS traffic; conduct vulnerability scans to identify exposed instances; escalate patch development tracking with Microsoft. Within 30 days: Deploy alternative secure remote access solutions (such as VPN gateways with MFA) where feasible; establish timeline for patching once vendor patch becomes available; document all interim compensating controls.

Windows CVE-2026-26111

HIGH

Heap-based Buffer Overflow (CWE-122)

2026-03-10 secure@microsoft.com

Windows Buffer Overflow Heap Overflow Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 13, 2026 - 20:43 vuln.today

Public exploit code

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 8.0

DescriptionCVE.org

Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Windows RRAS across Server 2016, 2022, and 2025 via an integer overflow vulnerability allows authenticated attackers to execute arbitrary code over the network with high privileges. Public exploit code exists for this vulnerability, and no patch is currently available. Authenticated users with network access can trigger the vulnerability through a simple interaction to gain complete system compromise.

Technical ContextAI

Classified as CWE-122 (Heap-based Buffer Overflow). Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.