EUVD-2026-99477
GHSA-f5cc-g3xv-j56w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious RRAS endpoint
-
DeliveryDeliver crafted remote-access traffic
-
ExploitTrigger heap buffer overflow (CWE-122)
-
ExecutionExecute arbitrary code on host
-
ImpactGain unauthorized machine access
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target Windows system to have the Routing and Remote Access Service (RRAS) role installed and enabled - an optional component that is NOT present in default Windows installations - which sharply limits the exposed population. The CVSS vector's UI:R means a user/victim must perform an action (e.g., initiating or accepting a connection to the attacker-controlled remote-access endpoint or processing attacker-supplied RRAS traffic); it is not a no-click remote exploit. No authentication is needed (PR:N confirms unauthenticated), but the required user interaction plus the non-default RRAS role are the two concrete factors that constrain realistic exploitation. Affected builds span Windows 10/11 and Windows Server 2012-2025 below the fixed revisions listed in EUVD. |
| Impact | Signals are mixed and point to a serious-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, unauthenticated heap overflow (CWE-122) with total CIA impact - on paper a high-severity RCE. However, two independent signals temper this: the vector itself requires user interaction (UI:R), and CISA's SSVC decision data states Exploitation=none, Automatable=no, Technical Impact=total. The 'Automatable: no' plus 'UI:R' combination means this cannot be sprayed at scale and needs a victim to be lured into acting, which substantially lowers real-world urgency versus a wormable RRAS flaw. No KEV listing and no public POC were provided, and EPSS is MISSING from the input - so exploitation probability cannot be quantified. CONFLICT/CAVEAT TO VERIFY: the 'Authentication Bypass' tag contradicts both CWE-122 (heap buffer overflow) and the PR:N/UI:R RCE vector, which describe memory-corruption code execution, not an auth-bypass primitive - treat that tag as suspect. Also note RRAS is an optional Windows role that is not enabled by default, so the exploitable population is a fraction of the (otherwise ubiquitous) Windows install base. Net: patch on normal Patch-Tuesday cadence, prioritizing any internet-facing or VPN-gateway hosts actually running RRAS, but this is not a drop-everything issue absent evidence of active exploitation. |
| Exploit ScenarioDerived | An attacker stands up a malicious RRAS/remote-access endpoint and lures a victim (or a victim's RRAS-enabled Windows host) into connecting or processing crafted remote-access traffic (UI:R). The malformed data triggers a heap-based buffer overflow in the RRAS component, letting the unauthenticated attacker execute arbitrary code and gain unauthorized control of the victim machine. No public exploit identified at time of analysis, and SSVC reports exploitation status as none. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote code execution in Microsoft's Windows Routing and Remote Access Service (RRAS) lets a remote, unauthenticated attacker corrupt heap memory and execute code on affected hosts, though exploitation requires the victim to perform an action (UI:R) such as initiating or accepting a connection to attacker-controlled remote-access traffic. The Routing and Remote Access Service is an optional Windows role that is not installed by default, which sharply limits the exposed population to systems explicitly configured as VPN or dial-up servers. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as 'none'; Microsoft has released fixes, and all Windows 10/11 and Windows Server 2012 through 2025 builds below the fixed revisions listed by EUVD are affected.
RemediationAI
Vendor-released patch: Microsoft has published fixes for this issue; patch availability is confirmed from vendor, and administrators should apply the Microsoft Security Response Center updates referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85339 to bring each platform up to at least the fixed build revisions listed in the affected-versions data (for example 10.0.17763.9376 for Windows Server 2019 / Windows 10 1809, 10.0.14393.9612 for Windows Server 2016 and Windows 10 1607, 10.0.19044.7807 for Windows 10 21H2/22H2, 10.0.20348.5761 for Windows Server 2022, 10.0.22631.7652 for Windows 11 23H2, 10.0.26100.33650 for Windows Server 2025, 6.2.9200.26434 for Windows Server 2012 and 6.3.9600.23470 for Windows Server 2012 R2), noting that legacy Server 2012/2012 R2 may require Extended Security Updates. Where RRAS is not operationally required - the common case, since it is a non-default role - the highest-value compensating control is to remove or disable the Routing and Remote Access Service role entirely; the trade-off is loss of VPN, dial-up and LAN routing functionality on that host, so this is best applied to servers that were never intended to terminate remote-access connections. If RRAS must stay enabled, restrict reachability to the remote-access listener with host-based firewall rules and network ACLs so that only known VPN client address ranges can reach the RRAS ports (PPTP 1723/TCP and GRE, L2TP/IPsec 1701/UDP and 500/4500/UDP, SSTP 443/TCP), and prefer IKEv2 or SSTP over the deprecated PPTP/L2TP paths; the trade-off is that roaming or NATed clients on unanticipated address ranges will need explicit allow-listing. Because the CVSS vector includes UI:R, user awareness training to avoid initiating or accepting connections to untrusted remote-access endpoints provides limited additional risk reduction, and monitoring RRAS event logs plus Microsoft's service crash telemetry for anomalous heap-corruption patterns (repeated service restarts, unexpected w3wp/RemoteAccess termination) can offer early detection while patching is staged. Note that no public exploit code has been identified at time of analysis, so the urgency is driven by the severity of the defect and the breadth of unpatched builds rather than by observed attack activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a heap-based buffer overflow (CWE-122) in Microsoft's Routing and Remote Access Service, the optional Windows Server role that provides multi-protocol LAN-to-LAN and remote-access VPN routing, including PPTP, L2TP/IPsec, SSTP/IKEv2 and dial-up termination. A heap overflow in a network-facing service classically arises when a length or size field in an attacker-supplied packet is trusted and used to copy data into a fixed-size heap allocation without sufficient bounds validation, allowing adjacent heap metadata or objects to be overwritten and, under the right allocation grooming, control flow to be hijacked - hence the RCE rating with High confidentiality, integrity and availability impact. The supplied tags also reference Authentication Bypass alongside Buffer/Heap Overflow and RCE, consistent with a flaw that may be reached before credentials are validated during connection negotiation. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms the attack surface is network-reachable and requires no privileges (unauthenticated), but the UI:R component means a victim-side action is needed, so this is not a no-click, wormable remote exploit. Exploitation is further gated by the RRAS role itself being a non-default, administrator-installed component; hosts that never enabled RRAS are not exposed regardless of patch level.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable RRAS with no auth (PR:N) but a victim action is required (UI:R); heap overflow yields full code execution, so C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Executive ViewAI
A high-severity memory-corruption flaw in Microsoft's optional Windows Routing and Remote Access Service (RRAS) could allow an attacker to run arbitrary code on any Windows 10/11 or Windows Server 2012 through 2025 host where that role has been enabled, which in practice means VPN and dial-up servers. Exposure is confined to the relatively small set of systems where administrators deliberately installed and configured RRAS, and a successful attack also requires a user on the target to initiate or accept a connection, so the practical attack surface is narrow. Leadership should still care because these servers typically sit at the network edge and broker remote access for large parts of the workforce, making any compromise disproportionately disruptive.
Apply vendor patch. Where the RRAS role is not operationally required, disabling or removing it eliminates exposure entirely; for hosts that must remain in service, restrict inbound remote-access traffic to trusted sources and block unsolicited connection attempts until patching completes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB