Microsoft warns of critical remote code execution flaw in Windows RRAS
A new vulnerability in Windows Routing and Remote Access Service allows attackers to execute code remotely, carrying a CVSS score of 9.8.
Key points
- CVE-2026-85809 allows remote code execution in Windows RRAS.
- The flaw is rated Critical with a CVSS score of 9.8.
- The vulnerability stems from a buffer overflow weakness (CWE-122).
Microsoft has published an official advisory regarding CVE-2026-85809, a remote code execution vulnerability affecting the Windows Routing and Remote Access Service. The National Vulnerability Database lists the flaw as Critical with a CVSS score of 9.8, indicating severe risk to affected systems.
The vulnerability allows an attacker to gain unauthorized access to a victim's machine through the RRAS component. According to the Microsoft Security Update Guide, the issue enables remote code execution, allowing attackers to compromise the target system.
Technical context and severity
The National Vulnerability Database identifies the underlying weakness as CWE-122, which refers to a buffer overflow error. This type of flaw typically occurs when a program writes data beyond the allocated memory space, potentially allowing attackers to overwrite critical system instructions.
Microsoft’s advisory summary states that the issue allows an attacker to gain unauthorized access to the victim's machine. The high severity rating reflects the critical nature of the remote code execution capability described in the CVE record.
Affected systems and exposure
The vulnerability specifically impacts the Windows Routing and Remote Access Service, a component often used in enterprise environments to manage network connections and routing protocols. Systems running this service are directly exposed to the risk described in the CVE record.
According to the source material, the flaw allows remote code execution, meaning attackers can target the RRAS component remotely. This remote nature increases the potential impact on systems that rely on RRAS for connectivity and network management.
What should you do?
Organizations should immediately audit their Windows environments to determine if the Routing and Remote Access Service is active. If the service is not required, administrators should consider disabling it to reduce the attack surface while awaiting further guidance from Microsoft.
Security teams should monitor network logs for unusual traffic patterns or unauthorized access attempts targeting RRAS ports. Since the source material does not confirm a specific fix, isolating affected systems from untrusted networks may help mitigate immediate risk.
What to do and how to stay safe: Microsoft
- Inventory all Windows servers running the Routing and Remote Access Service to assess exposure to CVE-2026-85809.
- Disable the RRAS service on systems where it is not strictly necessary to prevent remote exploitation.
- Monitor firewall logs for unauthorized connection attempts to ports associated with RRAS traffic.
- Prepare to apply updates immediately once Microsoft releases a confirmed patch or mitigation guidance.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-85809?
It is a remote code execution vulnerability in the Windows Routing and Remote Access Service that allows attackers to gain unauthorized access to a machine.
How severe is this vulnerability?
The National Vulnerability Database rates CVE-2026-85809 as Critical with a CVSS score of 9.8, indicating a high risk of exploitation.
Is there a patch available for this flaw?
The provided source material does not confirm the availability of a patch or fix, so no update has been verified yet.
