Windows RRAS CVE-2026-85809

The Routing and Remote Access Service (RRAS) role must be installed and enabled on the target host, and its network listener must be reachable by the attacker - RRAS is NOT enabled by default on Windows, which is the primary factor limiting real-world exposure to hosts acting as VPN/routing/dial-up gateways. Where RRAS is running and network-exposed, no further conditions apply: per CVSS AV:N/AC:L/PR:N/UI:N exploitation is remote, unauthenticated, low-complexity, and requires no user interaction. Affected builds span Windows 10/11 (multiple versions) and Windows Server 2012 through 2025 below the patched build numbers listed in EUVD-2026-99519; fully patched builds are not vulnerable.

This is a genuine high-priority vulnerability, though the signals are mixed and warrant nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst case: network-reachable, low-complexity, unauthenticated, no user interaction, with total (C:H/I:H/A:H) impact via a CWE-122 heap-based buffer overflow - consistent with a 9.8 CRITICAL. CISA's SSVC framework reinforces urgency on impact (Technical Impact: total) and Automatable: yes, meaning the attack can be reliably scripted/wormable. However, SSVC Exploitation is 'none' and there is no CISA KEV listing and no identified public exploit code, so the threat today is potential rather than observed. No EPSS score was provided, so probabilistic exploitation likelihood cannot be factored in - this is a real gap. The key limiting factor NOT reflected in the CVSS score is that RRAS is an optional Windows role that is not enabled by default; the 9.8 applies only where RRAS is deployed and network-exposed. Net: treat as a priority patch for any host running RRAS (especially internet-facing VPN/routing gateways), but the ubiquitous-on-paper CVSS overstates exposure for the typical Windows estate where RRAS is absent.

An attacker who can reach the RRAS service over the network (e.g., an internet-facing VPN/routing gateway) sends a crafted packet that triggers a heap-based buffer overflow in the RRAS parsing code, corrupting heap memory to achieve remote code execution without authentication or user interaction. Per CVSS AC:L this requires no special timing or conditions once the service is reachable. No public exploit code has been identified at time of analysis, so weaponization effort currently rests with the attacker.