Windows RRAS: Null pointer dereference causing denial of service

Summary

A null pointer dereference in the Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to crash the service over the network, causing a denial of service. No login is required, so the risk depends on whether RRAS is enabled and reachable from untrusted networks. The impact is limited to availability; no loss of confidentiality or integrity is stated.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809, 21H2, 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1, 26H2
• Windows Server 2012 and 2012 R2 (including Server Core)
• Windows Server 2019, 2022 and 2025 (listed by secondary sources only)

Fixed in

• Windows 10 1607 and Windows Server 2016: build 10.0.14393.9612 (KB5126868, October 13, 2026)
• Windows 10 1607 and Windows Server 2016: build 10.0.14393.9615 (KB5134123, out-of-band, October 26, 2026), which includes the 9612 fix
• Other products: builds at or above the thresholds listed under affected, per the CVE record

Workaround

• No CVE-specific workaround is known.
• If RRAS is not required, disable the role or service.
• Block access to RRAS from untrusted networks with a firewall.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No evidence of exploitation in the wild and no public proof of concept was found; this is not confirmed absence.
• EPSS score: 0.01149 (low).

Our recommendation

• Check whether RRAS is enabled and reachable from untrusted networks, and disable or firewall it if not needed.
• Inventory Windows 10 1607 and Windows Server 2016 hosts.
• Install build 10.0.14393.9615 or the build matching your product in the next maintenance window.
• Note the lifecycle conflict: Microsoft's release-health page states that Windows 10 Enterprise LTSB 2016 reached end of updates on October 13, 2026, while the release-information page lists build 14393.9615 with ESU. Confirm which applies to your licence. Consumer 1607 devices are out of support and should be replaced or moved to an ESU route.
• After patching, watch for reported Exchange mail issues linked to the October 2026 1607 update and verify Microsoft's known-issues page before applying any workaround.
• Recheck CISA KEV and public exploit sources regularly.
• No action needed for systems without RRAS and without affected builds.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-84017 msrc.microsoft.com
• KB5126868: Windows 10 1607 security update support.microsoft.com
• KB5134123: Windows 10 1607 update support.microsoft.com
• Windows 10 1607 and Windows Server 2016 release health status learn.microsoft.com
• Windows release information learn.microsoft.com
• NVD record via Vulners vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:41.