Windows RRAS CVE-2026-84015

Exploitation requires the target Windows host to be running the Routing and Remote Access Service (RRAS) / Remote Access role with PPP EAP-TLS authentication enabled, and the attacker must be able to reach the PPP/EAP-TLS endpoint over the network to deliver a crafted EAP-TLS message. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed once that service is exposed. The principal limiting factor is that RRAS with EAP-TLS is not a default Windows configuration - standard clients and servers without the Remote Access role configured for EAP-TLS are not exposed - which materially narrows the realistically attackable population despite the 9.8 score.

This is a genuine high-priority vulnerability, though the signals are mixed rather than uniformly alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, network-reachable, low-complexity remote code execution flaw with total confidentiality, integrity, and availability impact (C:H/I:H/A:H), scoring 9.8 - the maximum-tier profile for a pre-auth RCE. CISA's SSVC framework reinforces part of this picture (Technical Impact: total, Automatable: yes), but crucially sets Exploitation: none, meaning no observed or proof-of-concept exploitation at assessment time. There is no CISA KEV listing and no POC referenced in the provided data, so per the precision rules this is 'no public exploit identified at time of analysis' - the 9.8 reflects potential, not demonstrated, exploitation. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from this data. The key nuance the raw score hides: the vulnerable code path is the Remote Access (RRAS) PPP EAP-TLS handler, which is only exposed when the Windows host is configured as a Remote Access/RAS server with EAP-TLS authentication - not a default-on service on most Windows installations. So while the per-vulnerable-host severity is critical and heap-overflow RCEs are highly attractive to attackers, the real-world exposed population is narrower than the ubiquitous Windows footprint implies. Patch availability from Microsoft makes prioritized patching the clear action for any RRAS/VPN server.

An attacker who can reach a Windows host acting as a Remote Access (RRAS) server with PPP EAP-TLS enabled sends a crafted EAP-TLS handshake message that overflows a heap buffer in the PPP EAP-TLS parsing code (CWE-122). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires no authentication and no user interaction, allowing the attacker to corrupt heap memory and execute arbitrary code in the context of the vulnerable service. No public exploit is identified at time of analysis, so this remains a theoretical-but-realistic chain rather than confirmed in-the-wild activity.