EUVD-2026-99504
GHSA-8jfx-pv92-cgw3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach RRAS endpoint over network
-
DeliverySend crafted RRAS protocol packets
-
ExploitTrigger use-after-free in RRAS
-
ExecutionCorrupt heap and hijack control flow
-
ImpactExecute arbitrary code in service context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The Routing and Remote Access Service (RRAS) role must be installed and enabled on the target Windows host - this is the specific prerequisite, and because RRAS is not enabled by default, only systems deployed as VPN, dial-up, NAT, or LAN/WAN routing gateways are exposed. Where the role is enabled, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed from the attacker; the only limiting factors are network reachability to the RRAS service and the non-default presence of the role itself. Affected builds span Windows 10/11 (1607 through 26H2/26H1) and Windows Server 2012 through 2025, including Server Core installations. |
| Impact | This is a credible high-priority vulnerability, though several signals require caveats. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) describes remote, unauthenticated, low-complexity code execution with full confidentiality/integrity/availability impact and no user interaction - the worst-case profile for a network service. The CWE-416 (Use-After-Free) classification is consistent with a memory-corruption RCE. Mitigating the raw score: the affected component, Windows Routing and Remote Access Service (RRAS), is NOT enabled by default on Windows, so the exploitable population is far smaller than the ubiquitous Windows install base implies - real exposure is concentrated on VPN/RAS/routing gateways. No EPSS score was supplied, so exploitation probability cannot be quantified. KEV status is not present in the input, so there is no confirmed active exploitation. No POC was indicated, so 'no public exploit identified at time of analysis.' CONFLICT/CAVEAT: the 'Authentication Bypass' tag is inconsistent with a CWE-416 use-after-free and with PR:N (there is no authentication to bypass when the vector is already unauthenticated) - this tag appears spurious and should not drive prioritization. No SSVC decision data was provided. Net: patch promptly on any host running the RRAS role, but blanket emergency treatment across all Windows assets is not warranted given the non-default service. |
| Exploit ScenarioDerived | An attacker with network reachability to a Windows server running the RRAS role (e.g., a VPN or dial-up/routing gateway) sends specially crafted RRAS protocol traffic that triggers a use-after-free in the service. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are required, and successful memory corruption yields code execution in the service's high-privilege context. No public exploit code was identified in the provided data, so exploitation currently requires original vulnerability-research effort. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10 and Windows 11 builds from 1607 through 26H1/26H2 as well as Windows Server 2012 through 2025, including Server Core installations, but only on hosts where the RRAS role is actually installed and enabled. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates an unauthenticated, remotely reachable attacker who requires neither credentials nor user interaction can corrupt memory in the service and gain full impact to confidentiality, integrity, and availability. Because RRAS is not a default role, exposure is limited to systems deployed as VPN, dial-up, NAT, or LAN/WAN routing gateways; a vendor patch is available and no public exploit identified at time of analysis.
RemediationAI
Apply the Microsoft security update for CVE-2026-85792 as published in the MSRC Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85792); the fixed build thresholds in the affected-version data are the remediation targets - for example 10.0.26100.9711 and 10.0.26100.33650 for the 24H2 / Server 2025 branch, 10.0.22631.7652 for Windows 11 23H2, 10.0.19044.7807 for Windows 10 21H2/22H2, 10.0.17763.9376 for Server 2019 and Windows 10 1809, 10.0.14393.9612 for Server 2016 and Windows 10 1607, 10.0.20348.5761 for Server 2022, 10.0.26200.9711 for Windows 11 25H2, 10.0.26300.9711 for 26H2, 10.0.28000.3231 for 26H1, 6.2.9200.26434 for Server 2012 and 6.3.9600.23470 for Server 2012 R2 - and verify that coverage for the legacy Server 2012/2012 R2 branches is valid under the customer's current servicing entitlement before relying on it. Where patching cannot be immediate, the highest-value compensating control is to stop the service and remove the role on any host that does not actually terminate VPN, dial-up, NAT, or routing traffic (Uninstall-WindowsFeature RemoteAccess / Routing, or set the RemoteAccess service to Disabled), accepting that this intentionally breaks those functions; for hosts that must keep RRAS, restrict reachability to the service with host firewall rules and perimeter ACLs so that only known VPN peer addresses and required ports (PPTP 1723/TCP plus GRE, L2TP 1701/UDP with IKE 500/UDP and 4500/UDP, SSTP 443/TCP) can reach it, understanding that this degrades roaming-client connectivity; and monitor the RRAS service for crash/restart patterns that would indicate exploitation attempts, since the endpoint-protection signal for memory-corruption bugs of this type is post-exploitation rather than pre-exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in Microsoft's Routing and Remote Access Service, the in-box Windows role that implements multi-protocol VPN termination (PPTP, L2TP/IPSec, SSTP, IKEv2), dial-up access, network address translation, and LAN/WAN routing on Windows hosts. Use-after-free flaws of this class arise when an object is freed while a pointer to it is still reachable - commonly through concurrent request handling, malformed packet sequences, or a race in the service's connection/interface bookkeeping - after which the dangling reference is dereferenced and attacker-influenced data can be written over reused heap memory, typically pivoting to control-flow hijack and code execution in the service context (SYSTEM). The supplied tags (Authentication Bypass, RCE, Use After Free, Memory Corruption) align with the CVSS vector's PR:N, confirming the attack path begins before authentication and is reachable over the network to the RRAS listener; the tag set also confirms the memory-corruption root cause rather than a configuration or logic flaw. Affected binaries are the RRAS service components shipped in the Windows client and server SKUs enumerated by the EUVD affected-version list, spanning NT 6.2/6.3 (Server 2012/2012 R2) through 10.0.14393, 10.0.17763, 10.0.19044/19045, 10.0.20348, 10.0.22631, 10.0.26100, 10.0.26200, 10.0.26300, and 10.0.28000 build families. No EPSS score or CISA KEV entry was supplied with this record.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable RRAS service exploitable without credentials or interaction (AV:N/PR:N/UI:N) yielding full code execution; AC:L retained per vendor despite UAF, impacts all High.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Executive ViewAI
A critical unauthenticated remote code execution vulnerability in Windows Routing and Remote Access Service (RRAS) affects Windows 10 and Windows 11 builds 1607 through 26H1/26H2, plus Windows Server 2012 through 2025, but only where the RRAS role is installed and enabled. Because RRAS is commonly used on VPN, dial-up, NAT, or routing gateways, a successful attack could fully compromise perimeter systems without credentials or user interaction, disrupting remote access and potentially opening a path into internal networks. No public exploit identified at time of analysis, but the unauthenticated network reachability and critical severity warrant immediate leadership attention.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB