Windows Routing and Remote Access Service: Remote code execution via double free

Summary

The Routing and Remote Access Service (RRAS) in several supported Windows 10, Windows 11 and Windows Server versions contains a double-free flaw (CWE-415) that allows remote code execution. According to the CVSS vector (8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), an attacker on the network needs only low privileges and no user interaction, and could gain unauthorized access with high impact on confidentiality, integrity and availability. The issue matters only where RRAS is installed and reachable, for example as a VPN gateway or router. Microsoft has released fixes, and no exploitation has been reported.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (builds before 10.0.14393.9612)
• Windows 10 Version 1809 and Windows Server 2019 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 and 22H2 (builds before 10.0.19044.7807 and 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H2 (builds before 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows Server 2012 and 2012 R2, including Server Core installations (builds before 6.2.9200.26434 and 6.3.9600.23470)

Fixed in

• Install the October 2026 Microsoft security update for the affected version. The fixed builds are the ones listed as the upper limit above (for example 10.0.14393.9612 or later for Windows 10 1607 and Server 2016).
• Per third-party reports, the October 2026 updates include this CVE (for example KB5126868 for Windows 10 1607 and Server 2016). These KB numbers still need to be confirmed on the MSRC advisory.

Workaround

• Unknown. No vendor mitigation for RRAS was found.
• Interim measure (not vendor guidance): restrict access to RRAS VPN and routing endpoints to known management networks.

Exploitation

• No evidence of active exploitation in the wild was found.
• No public proof of concept was found.
• CISA SSVC data: exploitation none, automatable no, technical impact total.
• No entry in the CISA KEV catalog was found.

Our recommendation

• Check whether RRAS is installed and active on any Windows system, especially servers used as VPN gateways or routers.
• Apply the October 2026 security update to all affected systems, starting with internet-facing ones.
• Restrict RRAS access to required networks and users, and do not expose it directly to the internet.
• Verify the end-of-support date for Windows 10 Version 1607 on Microsoft's lifecycle page and upgrade unsupported systems.
• Monitor RRAS and VPN logs for unusual connections or service crashes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70158 msrc.microsoft.com
• OpenCVE: CVE-2026-70158 app.opencve.io
• Vulners NVD: CVE-2026-70158 vulners.com
• Tenable Nessus plugin 365471 www.tenable.com
• Qualys Microsoft Patch Tuesday October 2026 review blog.qualys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:56.