Microsoft Windows RRAS: Deadlock allows denial of service over the network

Summary

A deadlock (CWE-833) in the Windows Routing and Remote Access Service (RRAS) allows an unauthenticated attacker on the network to cause a denial of service. Successful exploitation can interrupt routing and remote access functions, such as VPN endpoints running on Windows servers. The vulnerability has a CVSS 3.1 score of 7.5 (High) and affects availability only, with no confidentiality or integrity impact reported.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807, per CVE record; the listed range is unclear in third-party sources)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012 and Server Core (6.2.9200.0 to < 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core (6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)

Fixed in

Fixed builds according to third-party trackers, not yet confirmed against the MSRC table:

• Windows 10 1607 / Server 2016: 10.0.14393.9612
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: Unknown (listing unclear)
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2: 10.0.26100.9711
• Windows 11 25H2: 10.0.26200.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470

The fix is part of the Microsoft security update of 13 October 2026. The KB number for Windows 10 1607 is unknown.

Workaround

Unknown. No workaround is documented in the sources reviewed. Interim measure from general practice: restrict network access to RRAS services.

Exploitation

• No public proof-of-concept exploit found.
• No exploitation in the wild found.
• CISA SSVC: Exploitation none, automatable yes, technical impact partial.
• CISA KEV and GitHub advisories were not checked, so the status is unknown.

Our recommendation

• Check whether RRAS is installed on any Windows host and whether it is reachable from the internet.
• Apply the October 2026 security update to all affected systems; for Windows 10 1607, verify the fixed build against the MSRC advisory.
• If Windows 10 1607 is still in use, plan an upgrade, since it is at or near end of support and will receive no further fixes.
• Restrict access to RRAS services to required networks only.
• Monitor for service hangs or unexpected restarts of RRAS.
• Check the CISA KEV catalogue regularly for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-103558 msrc.microsoft.com
• VulDB: CVE-2026-103558 vuldb.com
• Strix: CVE-2026-103558 www.strix.ai
• Vulners NVD: CVE-2026-103558 vulners.com
• CVE Threat Intelligence: CVE-2026-103558 cve.threatint.com
• SonicWall: Microsoft security bulletin coverage for October 2026 www.sonicwall.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:41.