Microsoft Windows: Remote Code Execution in PPP EAP-TLS

Summary

A heap-based buffer overflow in the Remote Access Point-to-Point Protocol (PPP) EAP-TLS component of several Windows client and server versions allows an unauthorized attacker to execute code over the network. No privileges or user interaction are required according to the CVSS vector (AV:N/AC:L/PR:N/UI:N), so internet-exposed RRAS or VPN servers using this authentication path are the main risk. Microsoft rates the flaw as Important; the CVSS 3.1 base score is 9.8 (Critical), while Positive Technologies rates it 6.6 (Medium).

Affected

• Windows 10 Version 1607: 10.0.14393.0 to below 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to below 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9711
• Windows Server 2012 (including Server Core): 6.2.9200.0 to below 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to below 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to below 10.0.14393.9612
• Windows Server 2019 and 2022, 2025: not listed in the official CVE record; third-party sources differ, verify on the MSRC page

Fixed in

• Fixed builds per the official CVE record: Windows 10 1607 and Server 2016 10.0.14393.9612; 1809 10.0.17763.9376; 21H2 and 22H2 10.0.19044.7807 / 10.0.19045.7807; Windows 11 23H2 10.0.22631.7652; 24H2 and 25H2 10.0.26100.9711 / 10.0.26200.9711; 26H1 10.0.28000.3231; 26H2 10.0.26300.9711; Server 2012 6.2.9200.26434; Server 2012 R2 6.3.9600.23470
• Install the October 2026 security update for each platform. The KB numbers could not be confirmed from the sources; check the MSRC page.

Workaround

Unknown.

• If Remote Access (RRAS), VPN or PPP-based remote access is not needed on a host, disable it and block its ports at the perimeter (general guidance, not a vendor-documented mitigation).

Exploitation

• No exploitation in the wild known; CISA SSVC records exploitation as none.
• CISA SSVC: automatable yes, technical impact total.
• No public proof-of-concept found.
• Not listed in the CISA KEV catalog. EPSS score 0.00893 (low).

Our recommendation

• Patch internet-facing RRAS and VPN servers first, then other affected Windows hosts with the October 2026 cumulative update.
• Inventory where RRAS, VPN or PPP EAP-TLS remote access is enabled and disable what is not needed.
• Replace or isolate legacy systems (Windows 10 1607, Server 2012 and 2012 R2) that cannot be patched; verify their support status on Microsoft's lifecycle page.
• Monitor VPN and remote access logs for unusual authentication or crash activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-84015 msrc.microsoft.com
• NVD mirror (Vulners): CVE-2026-84015 vulners.com
• Microsoft advisory mirror (Vulners): MS:CVE-2026-84015 vulners.com
• OpenCVE: CVE-2026-84015 app.opencve.io
• Rapid7 mirror (Vulners): CVE-2026-84015 vulners.com
• Strix: CVE-2026-84015 www.strix.ai
• Ugetfix: KB5126651 update information ugetfix.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:30.