Windows RRAS CVE-2026-70158

Exploitation requires the target Windows host to have the Routing and Remote Access Service (RRAS) role/feature installed and running, as this is the vulnerable component named in the description; RRAS is not enabled by default on standard Windows installations, which materially limits the exposed population. The CVSS vector's PR:L indicates the attacker must already hold a low-privilege/authenticated position to reach and trigger the flaw, so purely anonymous exploitation is not supported by the available data. No user interaction is required (UI:N), and the attack is network-reachable (AV:N) against systems below the listed patched build numbers.

This is a credible high-priority vulnerability. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, remote code execution flaw requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact. CWE-415 (Double Free) is consistent with a memory-corruption RCE rather than the 'Authentication Bypass' implied by the input tags - treat that tag as suspect. Exploitation signals are limited: there is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so per the available evidence this is 'no public exploit identified at time of analysis' and should not be described as actively exploited. The balance is a high-severity, Microsoft-reported, patch-available bug in a Windows network role with no confirmed exploitation yet; prioritize patching where the RRAS role is enabled, but there is no signal of mass or opportunistic exploitation at this time. Note: PR:L indicates the attacker needs some authenticated/low-privilege foothold, which meaningfully constrains purely anonymous remote exploitation despite AV:N.

An attacker with a low-privileged authenticated foothold (consistent with PR:L) sends specially crafted traffic to a Windows host running the Routing and Remote Access Service, triggering a double-free memory-corruption condition. Successful exploitation yields arbitrary code execution in the context of the RRAS service with full impact to confidentiality, integrity, and availability. No public exploit code was identified in the provided intelligence.