Windows RRAS EUVD-2026-56396

The Windows Routing and Remote Access Service (RRAS) must be installed, enabled, and actively running on the target system - it is not enabled by default on Windows desktop editions and must be explicitly configured as a server role on Windows Server. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms the attack is network-initiated, requires no authentication, and requires no user interaction, but the high attack complexity (AC:H) indicates the attacker must satisfy specific exploitation conditions, most likely a precise heap layout, race condition timing, or protocol negotiation state within the RRAS service. The 'Authentication Bypass' tag indicates normal credential checks are circumvented through the memory corruption itself. Exploitation is constrained to systems where RRAS is running and where RRAS protocol ports are reachable from the attacker's network position; systems behind firewalls blocking VPN/routing ports or with RRAS disabled have no attack surface. No non-default configuration beyond RRAS being active appears required.

The CVSS base score of 8.1 reflects a network-accessible, unauthenticated RCE with full CIA impact, moderated only by high attack complexity (AC:H). The AC:H metric is a meaningful real-world moderating signal - reliable UAF exploitation against a network service frequently demands precise heap manipulation or race condition timing, limiting opportunistic mass exploitation and favoring skilled, targeted attackers. No CISA KEV listing and no confirmed public proof-of-concept reduce urgency relative to a confirmed in-the-wild exploit; however, absence of KEV is not confirmation of non-exploitation. The 'Authentication Bypass' tag is a significant amplifier: if the authentication barrier is eliminated through memory corruption, the PR:N designation becomes self-reinforcing and removes a key defensive layer. The population of vulnerable systems is exceptionally large - Server 2012 through 2025 plus multiple Windows 10/11 branches - meaning the aggregate exposure surface is very high even if per-host exploitation probability is moderated by AC:H. Organizations with RRAS exposed to untrusted networks (public-facing VPN gateways, ISP routing infrastructure) face materially elevated risk and should treat this as urgent. Internal or firewalled RRAS deployments have significantly reduced exposure.

An unauthenticated remote attacker identifies a Windows Server system with RRAS exposed on a VPN gateway port (for example, IKEv2 on UDP/500) and sends a sequence of specially crafted protocol packets designed to trigger a use-after-free condition in the RRAS memory handler. By manipulating heap allocation patterns to control the contents of the freed memory region - a step consistent with AC:H complexity - the attacker redirects RRAS execution flow to shellcode or a ROP chain, achieving arbitrary code execution under the RRAS service context and gaining unauthorized access to the victim machine. No public exploit code has been identified at time of analysis.