EUVD-2026-99520
GHSA-rfc4-vhvw-fcrx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed RRAS listener
-
ExploitSend crafted RRAS protocol packet
-
ExecutionTrigger out-of-bounds read in parser
-
ImpactCrash service and deny network access
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target host must have the Windows Routing and Remote Access Service (RRAS) role installed, enabled, and reachable on the network (e.g. a VPN/routing/remote-access server); RRAS is not enabled by default on Windows, so hosts without this role are not exploitable. When RRAS is exposed, exploitation needs no authentication and no user interaction (PR:N/UI:N) and only network reachability to the RRAS listener. The limiting factors are the non-default RRAS configuration and network path to the service; the maximum impact is a service/host availability loss, with no confidentiality or integrity effect. |
| Impact | The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) describes a network-reachable, unauthenticated, low-complexity attack with no user interaction, but the impact is availability-only (C:N/I:N) - this is a pure denial-of-service via an out-of-bounds read (CWE-125), not a code-execution or data-disclosure flaw. No EPSS score was supplied, so exploitation probability cannot be quantified; the CVE is NOT in CISA KEV and no public exploit code was provided, so there is no public exploit identified at time of analysis. The signals are therefore internally consistent but modest: high reachability offset by the fact that the worst outcome is a service crash, and by the real limiting factor that the Routing and Remote Access Service role must be installed and enabled and listening on the network - it is not enabled by default on Windows. CAVEAT: the input Tags include 'Information Disclosure', which directly conflicts with the CVSS confidentiality metric of C:N and with the description (DoS only) - treat the DoS characterization as authoritative. Net: a legitimate patch-soon item for hosts actually running RRAS/VPN/routing, not a drop-everything emergency for the general Windows fleet. |
| Exploit ScenarioDerived | An attacker with network access to a Windows host that has the Routing and Remote Access Service role enabled sends a crafted packet to the RRAS listener, triggering an out-of-bounds read that crashes the service and denies remote-access/VPN connectivity to legitimate users. No authentication or user interaction is required (PR:N/UI:N). No public proof-of-concept exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated, network-reachable attackers can deny service on Windows hosts that run the Routing and Remote Access Service (RRAS) by triggering an out-of-bounds read (CWE-125) that crashes or destabilizes the service. Rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability-only with no confidentiality or integrity effect, and exposure is restricted to systems where the non-default RRAS role is installed and its listener is reachable over the network, requiring no credentials and no user interaction. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; vendor patches are available.
RemediationAI
Apply the Microsoft security updates referenced in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85808); the EUVD-listed affected ranges resolve to the following fixed build baselines - 6.2.9200.26434 for Windows Server 2012/2012 Server Core, 6.3.9600.23470 for Windows Server 2012 R2, 10.0.14393.9612 for Windows Server 2016 and Windows 10 1607, 10.0.17763.9376 for Windows Server 2019 and Windows 10 1809, 10.0.19044.7807 for Windows 10 21H2/22H2, 10.0.20348.5761 for Windows Server 2022, 10.0.22631.7652 for Windows 11 23H2, 10.0.26100.9711 for Windows 11 24H2, 10.0.26100.33650 for Windows Server 2025, 10.0.26200.9711 for Windows 11 25H2, 10.0.26300.9711 for Windows 11 26H2, and 10.0.28000.3231 for Windows 11 26H1. Where patching cannot be applied immediately, the most effective compensating control is to remove or disable the RRAS role on hosts that do not require routing/VPN functionality (the role is not enabled by default, so auditing for its presence already narrows the exposure set); the trade-off is loss of VPN termination, NAT and routing services on that host. For hosts that must keep RRAS running, restrict network reachability to the RRAS listeners with host firewall rules and network segmentation so that only known VPN client networks and administrative addresses can reach the service, accepting that overly broad blocking will disrupt legitimate remote-access users; monitoring RRAS service crashes (e.g. unexpected termination of the RemoteAccess service and related event log entries) provides detection while mitigations are in place. Note that patch availability is confirmed per the vendor advisory (Patch: Available from vendor); no vendor patch version beyond the fixed builds above should be assumed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Routing and Remote Access Service (RRAS) is a Microsoft Windows Server networking role that provides multi-protocol routing (RIP, DHCP relay, NAT) and remote-access/VPN termination (PPTP, L2TP/IPsec, SSTP, IKEv2, demand-dial), exposing listeners that process packets from any network-reachable peer. The defect class is CWE-125 Out-of-bounds Read: network-supplied input is parsed without sufficient length or bounds validation, so the service reads past the end of an allocated buffer, producing an access violation that terminates or destabilizes the component rather than yielding a writable memory-corruption primitive - which is consistent with the assessed vector's availability-only impact (C:N/I:N/A:H) and explains why this is a DoS rather than a code-execution or information-disclosure issue. Affected platforms span the Windows 10, Windows 11 and Windows Server 2012 through 2025 code bases (both full and Server Core installations) whose RRAS builds fall below the fixed revisions; per the independent assessment, RRAS is not enabled by default, so only hosts where the role has been installed and enabled, and where the listener is reachable, are in scope.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable RRAS listener exploitable with no authentication or interaction (AV:N/AC:L/PR:N/UI:N); out-of-bounds read yields availability loss only (A:H, C:N/I:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
Executive ViewAI
Organizations running Windows hosts with the non-default Routing and Remote Access Service (RRAS) role are exposed to CVE-2026-85808, an unauthenticated network-reachable denial-of-service vulnerability that can crash or destabilize the service. Although the issue is availability-only with no confidentiality or integrity impact, successful exploitation could disrupt remote access and VPN connectivity for users relying on RRAS, affecting workforce productivity and remote operations. Patch available per vendor advisory; no public exploit identified at time of analysis, but leadership should prioritize patching because the service is network-reachable and requires no credentials or user interaction.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB