EUVD-2026-73709
GHSA-8v2m-9q25-q4cv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-facing RRAS listener
-
DeliverySend crafted remote-access request
-
ExploitTrigger heap buffer overflow
-
ExecutionHijack control flow
-
PersistExecute code as service
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target host must have the Windows Routing and Remote Access Service (RRAS) role installed and enabled with a network-reachable listener (VPN/routing/NAT), which is not the default state for most Windows or Windows Server installs; this is the key limiting factor. Where RRAS is running and reachable, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity are required, so any attacker with network line-of-sight to the RRAS service can attempt exploitation against a default RRAS configuration. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes the most dangerous profile: remotely reachable, low-complexity, no privileges, no user interaction, full compromise - consistent with the RCE and heap-overflow classification. Microsoft (the reporting source) confirms a patch is available, but there is no CISA KEV listing and no public proof-of-concept identified, so this is currently a high-severity-but-not-yet-observed-in-the-wild issue rather than a confirmed active threat. The realistic exposure is narrower than the 9.8 suggests because RRAS is an optional role that is not enabled by default; the true attack surface is hosts acting as VPN/routing gateways, which are by definition internet- or perimeter-facing and therefore high-value. Given the pre-auth memory-corruption nature and the huge patch matrix, any organization running RRAS-based VPN/routing - from a large enterprise down to a mid-sized municipal IT team operating a single remote-access gateway in kielce - should treat patching as urgent, while hosts without the RRAS role are effectively unaffected. |
| Exploit ScenarioDerived | An attacker who can reach the RRAS/VPN endpoint of a Windows gateway sends a crafted remote-access protocol request that overflows a heap buffer in the service. The corruption is leveraged to hijack execution and run attacker code in the service's context, granting a foothold on a perimeter host without any credentials or user action. No public exploit code has been identified yet, but the pre-auth, low-complexity profile makes reliable exploitation plausible once details circulate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Remote code execution in the Windows Routing and Remote Access Service (RRAS) lets network attackers run arbitrary code on affected hosts without authentication or user interaction. The flaw is a heap-based buffer overflow (CWE-122) in RRAS request handling, carrying a CVSS 9.8 and impacting the full supported Windows and Windows Server line (Windows 10/11 and Server 2012 through 2025). Microsoft has shipped fixes; no public exploit code or active-exploitation reporting has been identified at time of analysis.
RemediationAI
Apply the Microsoft security update for your specific build immediately - Patch available per vendor advisory, with fixed builds enumerated in EUVD-2026-73709 (e.g. Server 2022 10.0.20348.5622, Server 2025 10.0.26100.33438, Windows 11 24H2 10.0.26100.9445); see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69590 for the exact KB per SKU. If patching must be delayed, the primary compensating control is to disable the Routing and Remote Access Service on hosts that do not require it (removing the attack surface entirely, at the cost of VPN/routing functionality). Where RRAS must stay online, restrict reachability of RRAS/VPN listeners to trusted networks via host and perimeter firewall rules and require VPN clients to come through vetted paths, accepting that legitimate remote users on untrusted networks may be impacted. Prioritize internet-facing RRAS gateways first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 19 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RRAS is a Windows Server networking role (also present in client SKUs) that provides routing, VPN (PPTP/L2TP/SSTP/IKEv2), NAT, and dial-up remote-access services, typically listening on network-facing interfaces. The root cause is classed as CWE-122, a heap-based buffer overflow: attacker-controlled input processed by an RRAS component is copied into an undersized heap allocation, corrupting adjacent heap metadata or objects and enabling control-flow hijack. Because RRAS parses untrusted protocol data directly from the network, a malformed request can reach the vulnerable code path pre-authentication. The affected build matrix spans Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 including Server Core installations.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Pre-auth, low-complexity heap-overflow RCE reachable over the network with no user interaction yields full CIA impact; scope unchanged as code runs within the service host.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Executive ViewAI
A critical vulnerability in Windows Routing and Remote Access Service (RRAS) enables unauthenticated remote code execution on Windows 10/11 and Server 2012-2025 systems; no public exploit identified at time of analysis. This flaw affects network infrastructure components commonly deployed for VPN and dial-up connectivity, creating immediate risk if these systems are internet-facing or accessible from untrusted networks. Organizations with RRAS-enabled infrastructure face potential lateral movement, data exfiltration, and complete system compromise across their Windows estate.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB