Windows RRAS CVE-2026-84017

Exploitation requires that the target host have the Windows Routing and Remote Access Service (RRAS) role installed and network-reachable - RRAS is not enabled by default, so only servers configured as VPN gateways, routers, or dial-up/NAT endpoints are exposed. Given that precondition, the CVSS vector indicates no further limits: remote, unauthenticated, no user interaction (AV:N/PR:N/UI:N) with low attack complexity. The practical limiting factor is the deployment gate (RRAS must be running and the attacker must have a network path to its listener); the impact is confined to availability (service crash/DoS), with no confidentiality or integrity consequence.

Signals are consistent and point to a genuine availability risk but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated, no-user-interaction flaw, and with C:N/I:N/A:H the 7.5 score derives entirely from availability impact - a pure denial of service, not code execution or data exposure. CISA's SSVC framework corroborates a measured posture: Exploitation=none (no observed or public exploitation), Automatable=yes (the unauthenticated network trigger can be scripted at scale), and Technical Impact=partial (service disruption rather than full system takeover). No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a real patch priority for exposed RRAS servers rather than a high-CVSS-but-illusory issue - but it sits below RCE-class Windows bugs. One caveat to verify: although the CVSS vector asserts a network vector against the RRAS service, exploitation realistically requires that the Routing and Remote Access role actually be installed and listening, which narrows the exposed population well below the full Windows install base.

An attacker with network reach to a Windows server running the Routing and Remote Access Service sends a crafted RRAS protocol packet that dereferences a null pointer in the service, crashing it. No credentials or user interaction are required (PR:N/UI:N), and because the trigger is automatable the attacker can repeatedly knock the VPN/routing service offline. No public exploit code is identified at time of analysis.