Microsoft Confirms Critical CVE-2026-85792 in Windows RRAS Service
A newly disclosed remote code execution flaw in Windows Routing and Remote Access Service allows attackers to gain unauthorized machine access.
Key points
- Microsoft lists CVE-2026-85792 as a critical vulnerability in the Windows Routing and Remote Access Service.
- The flaw carries a CVSS 9.8 score and is linked to CWE-416 weaknesses according to the National Vulnerability Database.
- Successful exploitation permits an attacker to execute code remotely and access the victim's machine without authorization.
Microsoft has officially documented a critical remote code execution vulnerability affecting the Windows Routing and Remote Access Service (RRAS). The flaw, identified as CVE-2026-85792, allows attackers to gain unauthorized access to a victim's machine through remote code execution, according to the Microsoft Security Update Guide.
The National Vulnerability Database assigns a CVSS score of 9.8 to this issue, rating it as critical. The weakness is classified under CWE-416. This high severity score indicates that the vulnerability is rated as critical by the NVD, posing a significant risk to systems running the affected service.
Context and Background
The Microsoft advisory describes the vulnerability specifically as a remote code execution issue within the RRAS component. RRAS is a key networking feature that allows network administrators to configure and manage routing and remote access services on Windows servers. Because it handles network traffic and remote connections, it is a frequent target for attackers seeking initial access to enterprise networks.
According to the source material, the exploitation of this flaw enables an attacker to gain unauthorized access to the victim's machine. This means that once the vulnerability is triggered, the attacker can potentially run arbitrary code on the compromised system. Such capabilities often serve as a foothold for further lateral movement or data exfiltration within a targeted environment.
Who Is Affected
Systems running the Windows Routing and Remote Access Service are directly affected by CVE-2026-85792. While the specific Windows versions are not detailed in the provided summary, any deployment utilizing RRAS for network routing or remote connectivity is at risk. Organizations that rely on Windows servers for managing VPN connections or internal routing infrastructure should prioritize investigating their exposure to this specific CVE.
The impact is severe due to the remote nature of the exploit. Attackers can attempt exploitation remotely. This makes perimeter-facing servers or those exposed to untrusted networks particularly vulnerable. Security teams must verify which assets within their infrastructure are currently running the affected RRAS component.
What should you do?
Organizations should immediately audit their Windows server environments to identify any instances of the Routing and Remote Access Service. If RRAS is not required, it should be disabled or uninstalled to reduce the attack surface. For systems where RRAS is essential, administrators should monitor for unusual network activity that may indicate exploitation attempts, such as unexpected outbound connections or new process executions.
Security teams should also review firewall rules to ensure that traffic destined for RRAS ports is restricted to trusted sources only. Limiting access to known IP ranges can mitigate the risk of remote exploitation while a permanent solution is evaluated. Continuous monitoring of system logs for signs of unauthorized code execution is also recommended.
What to do and how to stay safe: Microsoft
- Audit Windows servers to identify if the Routing and Remote Access Service is installed and running.
- Disable or uninstall RRAS on any system where it is not strictly required for network operations.
- Restrict network access to RRAS ports by configuring firewall rules to allow connections only from trusted IP addresses.
- Monitor system logs and network traffic for anomalous behavior that could indicate active exploitation attempts.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-85792?
The National Vulnerability Database lists the CVSS score as 9.8, which is rated as critical.
What type of vulnerability is CVE-2026-85792?
It is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS).
Is a patch available for this vulnerability?
The provided source material does not confirm the availability of a patch or update for CVE-2026-85792.
