Windows RRAS CVE-2026-85322

Exploitation requires the target Windows system to have the Routing and Remote Access Service (RRAS) role installed, enabled, and network-reachable by the attacker - RRAS is not installed or running by default on Windows client or server, which is the single largest limiting factor. When RRAS is present and exposed, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and no special privileges are needed beyond network access to the service. Impact is bounded to confidentiality (information disclosure of uninitialized memory); there is no code execution, modification, or denial of service. Realistic risk concentrates on internet-facing or broadly-reachable remote-access/VPN gateways running RRAS.

Signals are consistent and point to a genuine but moderate-priority information-disclosure issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated read against systems running RRAS, yielding C:H with no integrity or availability impact (I:N/A:N) - the 7.5 score is driven entirely by confidentiality. CISA's SSVC framework corroborates this nuance: Exploitation is 'none' (no observed activity), Technical Impact is only 'partial' (not total system compromise), but Automatable is 'yes', meaning the memory-disclosure read could be scripted and repeated at scale against exposed endpoints. There is no CISA KEV listing and no POC referenced, so this is 'no public exploit identified at time of analysis'. The main tension is scope: although AV:N implies broad network exposure, exploitation is gated on the RRAS role being installed and reachable, which is NOT a default Windows configuration - so the effective attack surface is far narrower than 'all Windows hosts'. EPSS was not provided in the input and cannot be cited. Net: patch on a normal prioritized cadence (elevate for internet-facing RAS/VPN gateways), but this is not a drop-everything confirmed-exploited flaw.

An unauthenticated attacker with network reachability to a Windows host running the Routing and Remote Access Service sends crafted RRAS protocol traffic that triggers the service to return the contents of an uninitialized memory buffer. The leaked bytes may contain fragments of sensitive process memory (pointers, tokens, or prior message data) usable for further attacks. No public exploit or active exploitation is referenced, and the attack requires RRAS to be enabled and exposed.