EUVD-2026-73673
GHSA-xqgg-47jc-9rj5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible RRAS service reachable with low-privilege credentials; heap overflow yields full process compromise with no user interaction or scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
AnalysisAI
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows a low-privileged network attacker to fully compromise affected Windows systems via a heap-based buffer overflow in the RRAS service. The vulnerability spans an unusually wide range of releases - Windows Server 2012 through Server 2025 and Windows 10/11 - suggesting a systemic flaw in a shared RRAS code path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The RRAS service must be enabled and running on the target Windows system - it is not enabled by default on most Windows editions but is common on Windows Server hosts deployed as VPN gateways or routers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a high-severity network-exploitable flaw that demands only low-privilege credentials - the realistic concern for organizations running RRAS as a VPN concentrator, where any valid VPN account could serve as the required low-privilege principal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch available: apply the Microsoft Security Update corresponding to your Windows build via Windows Update, WSUS, or SCCM. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and classify all Windows Server 2012/2016/2019/2022/2025 and Windows 10/11 systems running RRAS by business criticality, prioritizing internet-facing servers and network infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today