Windows Routing and Remote Access Service: Remote code execution (use-after-free)

Summary

A use-after-free flaw (CWE-416) in the Routing and Remote Access Service (RRAS) of supported Windows 10, Windows 11 and Windows Server versions allows remote code execution. An unauthenticated attacker can send crafted network traffic to a reachable RRAS service and gain unauthorized access to the machine, with no user interaction needed. The CVSS 3.1 base score is 9.8 (critical). Systems that do not run RRAS are not affected.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (builds below 10.0.14393.9612)
• Windows 10 Version 1809 (builds below 10.0.17763.9376)
• Windows 10 Version 21H2 (builds below 10.0.19044.7807)
• Windows 10 Version 22H2 (builds below 10.0.19045.7807)
• Windows 11 Version 23H2 (builds below 10.0.22631.7652)
• Windows 11 Version 24H2 (builds below 10.0.26100.9711)
• Windows 11 Version 25H2 (builds below 10.0.26200.9711)
• Windows 11 Version 26H1 (builds below 10.0.28000.3231)
• Windows 11 Version 26H2 (builds below 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (builds below 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (builds below 6.3.9600.23470)

The affected list in the sources is not complete for all editions. Verify against the MSRC advisory.

Fixed in

• Windows 10 1607 / Server 2016: 10.0.14393.9612 or later
• Windows 10 1809: 10.0.17763.9376 or later
• Windows 10 21H2: 10.0.19044.7807 or later
• Windows 10 22H2: 10.0.19045.7807 or later
• Windows 11 23H2: 10.0.22631.7652 or later
• Windows 11 24H2: 10.0.26100.9711 or later
• Windows 11 25H2: 10.0.26200.9711 or later
• Windows 11 26H1: 10.0.28000.3231 or later
• Windows 11 26H2: 10.0.26300.9711 or later
• Windows Server 2012: 6.2.9200.26434 or later
• Windows Server 2012 R2: 6.3.9600.23470 or later

The matching KB numbers are not verified. Use the MSRC Security Update Guide to find them.

Workaround

Unknown.

• No vendor workaround or mitigation was found in the sources reviewed.
• Where RRAS is not needed, disabling the role or blocking its access with a firewall is a sensible interim measure. This is a recommendation, not a vendor statement.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Not listed in the CISA KEV catalogue (per OpenCVE).
• No public proof of concept or exploitation report was found in a short search. This means nothing known yet, not that no exploit exists.

Our recommendation

• Check whether the RRAS role is installed on any system and whether it is reachable from the internet. Prioritize internet-facing VPN and routing servers.
• Confirm the exact Windows build and patch as soon as possible using the MSRC page.
• Windows 10 1607 (LTSB 2016) and Server 2016 are the most likely to be unpatched. Check Microsoft's lifecycle page, because support may have ended around the publication date.
• Disable or isolate RRAS where it is not needed, and restrict access to it with firewall rules.
• Monitor for public exploits and CISA KEV listing, and re-check weekly.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85792 msrc.microsoft.com
• OpenCVE: CVE-2026-85792 app.opencve.io
• Vulners NVD mirror: CVE-2026-85792 vulners.com
• Vulners Rapid7 record: CVE-2026-85792 vulners.com
• VulDB: CVE-2026-85792 vuldb.com
• Zero Day Initiative: October 2026 security update review www.zerodayinitiative.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:28.