Windows RRAS CVE-2026-72959

The RRAS service must be enabled and running on the target Windows system - it is not enabled by default on most Windows editions but is common on Windows Server hosts deployed as VPN gateways or routers. The attacker must possess a low-privilege credential that allows initiating a connection to the RRAS endpoint (e.g., a valid VPN user account, domain credential, or equivalent low-trust network principal). The RRAS service port(s) must be reachable from the attacker's network position, which is typically true from the internet for internet-facing VPN concentrators. No user interaction is required. Exploitation is limited by the PR:L requirement: unauthenticated external attackers without any credential cannot directly trigger the flaw, distinguishing this from a fully unauthenticated network attack. Scope does not change (S:U), so post-exploitation impact is contained to the RRAS host itself rather than automatically propagating across systems.

CVSS 8.8 with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a high-severity network-exploitable flaw that demands only low-privilege credentials - the realistic concern for organizations running RRAS as a VPN concentrator, where any valid VPN account could serve as the required low-privilege principal. Attack complexity is low, meaning no race conditions or special environmental setup is needed beyond credential possession. The full triad impact (C:H/I:H/A:H) means a successful attack yields complete server compromise. No EPSS score is provided in the input, and the vulnerability is not listed in CISA KEV, so exploitation probability remains unquantified by public signal data. No public proof-of-concept has been identified. However, the extremely broad affected-version range (10+ distinct Windows releases spanning over a decade) substantially widens the potential attack surface across enterprise environments that have not applied patches. Risk priority is high for organizations exposing RRAS externally and should be treated as urgent patching given the low authentication bar and network accessibility.

An attacker who holds a low-privilege VPN or domain account on an organization using Windows Server as a RRAS-based VPN gateway connects to the RRAS listener and sends a specially crafted protocol message - such as a malformed PPTP or L2TP negotiation packet - that overflows a heap buffer in the RRAS service process. The overflow overwrites adjacent heap structures to redirect execution to attacker-controlled shellcode, granting the attacker SYSTEM-level code execution on the Windows Server host. No public proof-of-concept has been identified, but the low attack complexity (AC:L) means exploitation would not require advanced heap-grooming techniques once a trigger is discovered.