Microsoft Windows RRAS: Remote code execution vulnerability

Summary

A remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) allows an attacker to run code on an affected machine. The CVSS vector (9.8, Critical) rates it as network-reachable with low complexity, requiring no privileges and no user interaction. The CVE record describes a heap-based buffer overflow (CWE-122). Windows 10, Windows 11 and Windows Server 2012 to 2016 are affected, as listed below.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 (including Server Core): 6.2.9200.0 to before 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to before 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2: 10.0.26100.9711 and 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.9711
• Windows Server 2012 (including Server Core): 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): 6.3.9600.23470

Source: Microsoft Security Update Guide. Verify against MSRC before rollout.

Workaround

• No workaround is documented in the CVE record.
• If RRAS is not needed on a host, disable the role.
• If it is needed, restrict access to its VPN and management interfaces to trusted networks.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Not listed in CISA KEV.
• No public exploit or in-the-wild exploitation known as of 30 Oct 2026. This does not prove that none exists.

Our recommendation

• Inventory Windows hosts with the RRAS role, especially Windows 10 Version 1607 systems.
• Apply the Microsoft update to all affected systems, or retire unsupported Windows 10 1607 hosts.
• Restrict RRAS to trusted networks until patched, and never expose it directly to the internet.
• Plan as network-exploitable, since one third-party source describes a local attacker only.
• Monitor for a public exploit or KEV listing and re-rate if either appears.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85809 msrc.microsoft.com
• NVD mirror: CVE-2026-85809 (Vulners) vulners.com
• Microsoft advisory mirror: MS:CVE-2026-85809 (Vulners) vulners.com
• OpenCVE: CVE-2026-85809 app.opencve.io
• Zero Day Initiative: October 2026 Security Update Review www.thezdi.com
• Rapid7 classification mirror: RAPID7:CVE-2026-85809 (Vulners) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:25.