EUVD-2026-73728
GHSA-3p7c-fr6q-wvh6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach RRAS network endpoint
-
DeliverySend crafted RRAS protocol messages
-
ExploitTrigger use-after-free race
-
ExecutionGroom heap and hijack freed object
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target Windows host to have the Routing and Remote Access Service (RRAS) role installed and enabled (used for routing, RAS/dial-up, or VPN) and network-reachable to the attacker; RRAS is NOT enabled by default, which sharply limits real-world exposure to configured router/VPN/RAS servers. No authentication (PR:N) and no user interaction (UI:N) are needed, but the use-after-free demands winning a race or achieving reliable heap layout (AC:H), so exploitation is not deterministic and SSVC marks it non-automatable. Patched builds per EUVD (e.g. Server 2025 <10.0.26100.33438, Win10 22H2 <10.0.19045.7725, Win11 24H2 <10.0.26100.9445) close the flaw. |
| Impact | CVSS 3.1 base score is 8.1 (High) with a network vector (AV:N), no privileges (PR:N) and no user interaction (UI:N), but attack complexity is High (AC:H) - consistent with the CWE-416 use-after-free, which typically requires winning a race condition or precise heap grooming rather than a single deterministic request. All three impact metrics are High (C:H/I:H/A:H), and SSVC corroborates this with Technical Impact = Total. However, the exploitation signals point AWAY from urgent mass risk: SSVC Exploitation = none and Automatable = no, EPSS is only 0.42% (36th percentile), there is no CISA KEV listing, and no public exploit code was identified. These signals are internally consistent (low EPSS + SSVC none/no + no KEV + no POC all agree). The key qualifier is that RRAS is not enabled by default on Windows, so despite the ubiquitous OS footprint the real attack surface is limited to hosts configured as routers/RAS/VPN servers. Net: a credible RCE worth patching promptly on RRAS-enabled servers, but not currently a widely-exploited or automatable threat - priority driven by exposure (is RRAS enabled?) more than by observed exploitation. |
| Exploit ScenarioDerived | An attacker with network reachability to a Windows host running the Routing and Remote Access Service sends a crafted sequence of protocol messages to the RRAS-facing endpoint that triggers a use-after-free in the service. By grooming the heap and winning the required race (reflected in AC:H), the attacker corrupts memory to achieve remote code execution without any authentication or user interaction, gaining control of the server. No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 24, 2026
Remote code execution in Microsoft's Routing and Remote Access Service (RRAS) lets a network-positioned attacker with no credentials (PR:N) and no user interaction (UI:N) execute code with high impact to confidentiality, integrity and availability on affected Windows hosts by triggering a use-after-free (CWE-416) in the service. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 including Server Core installations, but the flaw is only reachable where an administrator has installed and enabled the RRAS role - it is not enabled by default, concentrating real exposure on routing, RAS/dial-up and VPN servers that are network-reachable. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' (and non-automatable), and EPSS is low at 0.42% (36th percentile); the High attack complexity (AC:H) reflects the race-condition/heap-grooming reliability problem typical of use-after-free bugs.
Earlier versions of this analysis (1)
Use-After-Free (CWE-416) in the Windows Routing and Remote Access Service enables an unauthenticated attacker positioned on an adjacent network to execute arbitrary code on affected Windows systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025 and Windows 10/11 client versions, making the exposure surface substantial in enterprise environments where RRAS is deployed as a VPN or routing endpoint. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS C:H/I:H/A:H impact and adjacent-network unauthenticated attack path make it a high-priority patching target for organizations running RRAS-enabled servers.
RemediationAI
Vendor-released patches are available per Microsoft's advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70570); apply the relevant Windows cumulative update to bring each host to at least the EUVD-listed fixed build - Windows Server 2012 6.2.9200.26349, Server 2012 R2 6.3.9600.23397, Server 2016/Windows 10 1607 10.0.14393.9512, Server 2019/Windows 10 1809 10.0.17763.9245, Windows 10 21H2 10.0.19044.7725, Windows 10 22H2 10.0.19045.7725, Windows 11 23H2 10.0.22631.7582, Windows 11 24H2 10.0.26100.9445, Windows Server 2022 10.0.20348.5622, Windows Server 2025 10.0.26100.33438, Windows 11 25H2 10.0.26200.9445, and Windows 11 26H1 10.0.28000.2954 - noting that Windows 10 1607/1809 and Windows Server 2012/2012 R2 require Extended Security Updates or an in-support upgrade path. Where immediate patching is impossible, the most effective compensating control is to remove the attack surface: uninstall or disable the Routing and Remote Access Service role (or stop and set the RemoteAccess service to Disabled with startup type Manual) on hosts that do not genuinely terminate VPN/RAS connections - trade-off is that all routing, dial-up and VPN functionality on that host stops. Perimeter filtering is the next option: block or tightly allowlist inbound PPTP (TCP 1723 and GRE protocol 47), L2TP (UDP 1701), IKE/IPsec (UDP 500 and 4500), SSTP (TCP 443) and any RRAS management interfaces so that only trusted VPN peers or management subnets can reach the service - trade-off is that remote workers connecting from unlisted networks lose VPN access, and 443 filtering can break unrelated TLS services. Segment the RRAS hosts onto a dedicated management network, monitor for repeated malformed connection attempts against RAS/VPN ports as a race-exploitation indicator, and prioritize patching of externally reachable VPN/routing servers given the total technical impact rating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 19 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RRAS is the Windows role that provides IP routing, remote access (dial-up/RAS) and VPN termination (PPTP, L2TP/IPsec, SSTP, IKEv2), implemented through the RemoteAccess service and associated components such as RAMgmtSvc and the IKE/IPsec stack, listening on standard RAS/VPN ports. The assigned CWE-416 (Use After Free) indicates that a memory object within the service is freed while a reference to it survives; a remote attacker can then reallocate or manipulate the freed region to corrupt adjacent heap structures and redirect execution, producing remote code execution in the context of the RRAS service (typically SYSTEM). The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H that accompanies the CVE is corroborated by our independent assessment: the network vector and absence of authentication or user interaction make any reachable RRAS endpoint a viable target, while AC:H and the SSVC 'Automatable: no' verdict acknowledge that a reliable exploit requires winning a race or achieving a deterministic heap layout rather than issuing a single crafted request. Public tagging also flags an authentication-bypass dimension, consistent with the attacker needing no prior credentials on the RRAS host, but the primary impact class remains memory corruption leading to RCE.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
RRAS is network-facing and unauthenticated (AV:N/PR:N/UI:N); the use-after-free needs a race/heap grooming (AC:H); successful RCE yields total host compromise (C:H/I:H/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Executive ViewAI
A use-after-free defect in Microsoft's Routing and Remote Access Service (RRAS) allows an unauthenticated, network-positioned attacker to run arbitrary code on Windows hosts where the RRAS role has been installed and enabled, with high impact to confidentiality, integrity and availability. Because RRAS is not on by default, the realistic exposure set is limited to routing, dial-up and VPN servers that are reachable from untrusted networks - but for organizations running those services on Windows 10 (1607-22H2), Windows 11 (23H2-26H1) or Windows Server 2012 through 2025 (including Server Core), leadership should treat this as a priority remediation item. Successful exploitation would give an external attacker a foothold with service-level privileges on a perimeter-facing system, so the organizational concern is potential lateral movement and disruption of remote-access connectivity, not just a single host compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB