Windows RRAS: Information disclosure through uninitialized resource
Summary
Windows Routing and Remote Access Service (RRAS) uses an uninitialized resource (CWE-908). A remote, unauthenticated attacker can send network traffic to an affected system and read information from it, with a high confidentiality impact. Integrity and availability are not affected. Exposure depends on whether RRAS runs on a reachable host, mainly Windows Servers with VPN or routing roles.
Affected
- Windows 10 Version 1607 (below 10.0.14393.9612)
- Windows 10 Version 1809 (below 10.0.17763.9376)
- Windows 10 Version 21H2 (below 10.0.19044.7807)
- Windows 10 Version 22H2 (below 10.0.19045.7807)
- Windows 11 Version 23H2 (below 10.0.22631.7652)
- Windows 11 Version 24H2 (below 10.0.26100.9711)
- Windows 11 Version 25H2 (below 10.0.26200.9711)
- Windows 11 Version 26H1 (below 10.0.28000.3231)
- Windows 11 Version 26H2 (below 10.0.26300.9711)
- Windows Server 2012, including Server Core (below 6.2.9200.26434)
- Windows Server 2012 R2, including Server Core (below 6.3.9600.23470)
- Windows Server 2016 (below 10.0.14393.9612)
Fixed in
- Install the October 2026 security update for your version. Fixed builds are listed under Affected.
- Tenable links KB5126651 (Windows 10 1809 / Server 2019) to this CVE. No KB article for Windows 10 1607 or Server 2016 was found in the sources reviewed.
Workaround
Unknown. No vendor workaround was found in the sources reviewed. Restricting network access to RRAS may reduce exposure, but this is not confirmed by the vendor.
Exploitation
- No known exploitation at the time of analysis.
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, partial technical impact.
- EPSS score about 1 percent.
- No public proof of concept found; absence in searches is not proof.
Our recommendation
- Identify hosts with the RRAS role, especially Windows Servers with internet-facing VPN or routing.
- Apply the October 2026 security update to affected systems and prioritise exposed servers.
- For Windows 10 1607 and Server 2016, check the Microsoft lifecycle page for support status; if support has ended, plan an upgrade.
- Restrict RRAS reachability from untrusted networks and monitor traffic to these services.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Information disclosure – Windows Routing and Remote Access Service (RRAS)
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation unlikely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-85322 msrc.microsoft.com
- NVD mirror (Vulners): CVE-2026-85322 vulners.com
- OpenCVE: CVE-2026-85322 app.opencve.io
- Strix: CVE-2026-85322 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:39.
Original description (NVD)
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.