Windows RRAS: Remote code execution in Routing and Remote Access Service

Summary

A remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) allows an attacker to run code on the affected machine. The CVE record lists CWE-122 (heap-based buffer overflow) and CWE-191 (integer underflow) as weakness types, and CVSS 3.1 rates it 8.8 (High). Microsoft's CVSS vector requires no privileges, but user interaction (UI:R) is needed. CISA SSVC assesses exploitation as 'none' and automatable as 'no'.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012, including Server Core (6.2.9200.0 to < 6.2.9200.26434)
• Windows Server 2012 R2, including Server Core (6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)

Fixed in

• Install the Microsoft security update for your Windows version. Fixed builds according to the CVE record:
• Windows 10 1607 and Server 2016: 10.0.14393.9612
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2 and 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2 and 25H2: 10.0.26100.9711 and 10.0.26200.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows 11 26H2: 10.0.26300.9711
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470

Workaround

Unknown.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public exploitation details were confirmed in the sources reviewed.

Our recommendation

• Apply the Microsoft security update to all affected Windows systems, prioritizing servers and systems with RRAS enabled (VPN, remote access, routing).
• Check whether RRAS is enabled and whether the systems are reachable from untrusted networks; restrict access to RRAS with firewall rules.
• Monitor for unusual network traffic to RRAS services and for unexpected processes on affected systems.
• Keep Windows 10 Version 1607 and Windows Server 2012 systems in mind: confirm they receive the fixed builds, as these versions are out of mainstream support.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85339 msrc.microsoft.com
• Vulners: NVD record CVE-2026-85339 vulners.com
• OpenCVE: CVE-2026-85339 app.opencve.io
• Vulners: Microsoft advisory MS:CVE-2026-85339 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:23.