EUVD-2026-73672
GHSA-xq8j-6r73-v4mq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach RRAS-enabled Windows host over network
-
DeliverySend crafted RRAS protocol request
-
ExploitTrigger heap buffer overflow (CWE-122)
-
ExecutionCorrupt memory and hijack control flow
-
PersistExecute arbitrary code in service context
-
ImpactFull system compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target Windows host to have the Routing and Remote Access Service (RRAS) role installed and enabled and reachable by the attacker over the network - RRAS is not enabled in default Windows/Windows Server installations, so systems without the routing/VPN role are not exposed. When RRAS is enabled and network-reachable, exploitation needs no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N) against the broad set of affected Windows 10/11 and Windows Server 2012 R2-2025 builds below the patched versions listed in EUVD. The primary limiting factors are the non-default RRAS role requirement and network reachability to the service. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) and CWE-122 heap-based buffer overflow describe a critical remote, unauthenticated, single-request RCE in the Windows RRAS component, and SSVC Technical Impact is 'total,' consistent with full code execution. However, the exploitation signals are markedly cooler than the raw severity: EPSS is only 0.89% (57th percentile), the vulnerability is NOT in CISA KEV, no POC is referenced, and SSVC records Exploitation='none' and Automatable='no'. This is a classic high-CVSS-but-not-yet-exploited profile - patch it on Microsoft's standard cadence, prioritizing internet-exposed or VPN/routing hosts, but there is no evidence of active exploitation to justify emergency out-of-band action. A key limiting factor not captured in the CVSS base score is that RRAS is an optional Windows role that must be enabled and reachable (typically VPN/dial-up/routing gateways), so real exposure is far narrower than the huge affected-OS CPE list implies. The 'Automatable: no' rating suggests any future exploitation may be more targeted than wormable, tempering the 9.8. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reach to a Windows server that has the RRAS role enabled sends a crafted protocol request that overflows a heap buffer in the RRAS service, corrupting memory to achieve remote code execution in the service context. No public exploit code is identified at time of analysis and the flaw is not listed in CISA KEV, so this remains a theoretical-but-critical path pending weaponization. Because AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required once RRAS is exposed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 21, 2026
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network-positioned attacker to execute arbitrary code with system privileges on affected Windows hosts by sending crafted requests to the RRAS service, a consequence of a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The exposure is conditioned on the host actually running the RRAS role: RRAS is not installed or enabled in default Windows and Windows Server configurations, so only machines explicitly deployed as routers, VPN concentrators, or remote-access gateways (and reachable from the attacker's network path) are at risk, which is consistent with the low EPSS score of 0.89% (57th percentile). Exploitation status at the time of analysis is "no public exploit identified at time of analysis" per CISA SSVC (Exploitation: none, Automatable: no, Technical Impact: total), and Microsoft has released vendor patches, making prompt patching of any internet- or WAN-exposed RRAS deployment the priority action.
Earlier versions of this analysis (1)
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker to execute arbitrary code with full system impact across a broad range of Microsoft Windows releases. The vulnerability (CWE-122) affects Windows 10, Windows 11, and Windows Server 2012 through 2025, with vendor-released patches available via MSRC. No public exploit code and no CISA KEV listing are identified at time of analysis, but the low authentication bar (PR:L) and wide platform coverage make this a high-priority patch for any organization operating RRAS-enabled servers.
RemediationAI
Apply the vendor-released Microsoft security update for CVE-2026-72950 as soon as possible; the fixed builds to target are 10.0.14393.9512 (Windows 10 1607 / Server 2016, including Server Core), 10.0.17763.9245 (Windows 10 1809 / Server 2019), 10.0.19044.7725 (Windows 10 21H2), 10.0.19045.7725 (Windows 10 22H2), 10.0.22631.7582 (Windows 11 23H2), 10.0.26100.33438 (Windows Server 2025 and Server Core) and 10.0.26100.9445 (Windows 11 24H2), 10.0.26200.9445 (Windows 11 25H2), 10.0.28000.2954 (Windows 11 26H1), 10.0.20348.5622 (Windows Server 2022), 6.2.9200.26349 (Windows Server 2012) and 6.3.9600.23397 (Windows Server 2012 R2, including Server Core), with the exact KB assignments listed in the Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72950) and EUVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-72950). Where patching cannot be completed immediately, the most effective compensation is to remove the attack surface rather than to filter it: stop and disable the Routing and Remote Access Service (and set the service to Disabled) on any host that does not perform routing or VPN termination, accepting the side effect that all RRAS-based routing, remote access and VPN functionality stops working on that host. For hosts where RRAS must remain in service, restrict which networks can reach the RRAS interfaces - block inbound PPTP (TCP 1723 and GRE), L2TP/IPsec (UDP 1701, UDP 500, UDP 4500), SSTP (TCP 443) and RRAS/RPC management traffic at perimeter and host firewalls, and allow only trusted internal management subnets, with the trade-off that legitimate remote users on those protocols must be routed through a vetted jump host or a segregated VPN gateway; alternatively, place the RRAS server behind a hardened VPN concentrator or TLS terminator so the vulnerable service is never directly reachable from untrusted networks, at the cost of added latency and an additional device to maintain. Monitor RRAS-related service crashes, unusual memory-corruption faults in svchost or the RRAS process, and anomalous inbound connection attempts to the ports above as a detection layer, but treat such monitoring only as a stopgap until the update is installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 19 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a heap-based buffer overflow (CWE-122) in Microsoft's Routing and Remote Access Service, the Windows component that provides multi-protocol LAN-to-LAN routing, demand-dial routing, and remote-access/VPN termination (including PPTP, L2TP/IPsec, SSTP and IKEv2, plus routing protocols such as RIP and OSPF) along with the RRAS management interfaces. A heap overflow in this class means the service writes more data into a heap-allocated buffer than it was sized for, corrupting adjacent heap metadata or objects; in a service that parses attacker-supplied network traffic, that corruption can typically be steered into controlled memory writes and ultimately arbitrary code execution in the RRAS service context. Because the vulnerable code path is reachable over the network with no authentication and no user interaction (CVSS PR:N/UI:N), a single crafted request against a listening RRAS endpoint is the theoretical exploitation primitive; the practical barrier is architectural rather than cryptographic, since RRAS must be installed and enabled and the relevant interfaces must be reachable. CVE-2026-72950 affects a broad OS footprint rather than a single SKU: CPE data identifies Windows 10 1607, 1809, 21H2 and 22H2 builds (x86, x64 and arm64 where applicable), and the vendor/EUVD data extends the scope to Windows 11 23H2, 24H2, 25H2 and 26H1 and to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - the long tail of supported builds reflects how deeply RRAS is embedded across the Windows servicing branches.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated single-request heap overflow reachable over the network with full code execution, so AV:N/AC:L/PR:N/UI:N and C/I/A:H; RRAS-role gating is a deployment precondition, not a base-metric change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Executive ViewAI
A critical unauthenticated remote code execution flaw in the Windows Routing and Remote Access Service (RRAS) allows anyone who can reach the service over the network to run code with system-level privileges, meaning full control of the host. Only systems where the RRAS role has been deliberately deployed - typically VPN concentrators, routers, and remote-access gateways - are exposed, so the risk is concentrated in a small but highly sensitive subset of the Windows server estate rather than the general endpoint population. Leadership should care because those gateways are internet-facing trust boundaries: a single compromised appliance can expose internal network paths and the remote-access sessions that depend on it.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB