CVE-2025-26667 Overview
CVE-2025-26667 is an information disclosure vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw allows an unauthenticated attacker to obtain sensitive information over a network when a targeted user interacts with a crafted request or resource. Microsoft classifies the issue under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability affects a broad range of Windows Server releases, from Windows Server 2008 through Windows Server 2025. Exploitation requires user interaction but does not require prior authentication or elevated privileges.
Critical Impact
A network-based attacker can disclose confidential memory or configuration data from RRAS-enabled Windows Server hosts without authentication when a user interacts with an attacker-controlled resource.
Affected Products
- Microsoft Windows Server 2008 SP2 and Windows Server 2008 R2 SP1
- Microsoft Windows Server 2012 and Windows Server 2012 R2
- Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-04-08 - CVE-2025-26667 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26667
Vulnerability Analysis
The vulnerability resides in the Routing and Remote Access Service (RRAS), a Windows Server role that provides routing, VPN, and dial-up remote access functionality. RRAS improperly handles data during network communication and exposes sensitive information to callers that should not receive it. An attacker crafts a network request that triggers RRAS to return memory contents or protocol metadata beyond the intended scope of the response.
Exploitation requires user interaction. In typical scenarios, an attacker convinces a user to connect to a malicious server or to click a link that initiates an RRAS-related connection. Successful exploitation compromises confidentiality but does not modify data or affect service availability. The disclosed information may include memory fragments, session data, or configuration values that assist further attacks against the target environment.
Root Cause
The root cause is improper handling of sensitive data within RRAS message processing routines, tracked as [CWE-200]. RRAS fails to enforce boundaries between internal state and outbound responses, allowing residual or protected information to reach an unauthorized network peer.
Attack Vector
The attack vector is network-based with low complexity. The attacker must induce a user to trigger the vulnerable code path, typically by initiating a connection to a malicious RRAS endpoint. No credentials are required on the target system. Microsoft has not published a proof-of-concept, and no public exploit code is available at the time of writing. See the Microsoft Security Update CVE-2025-26667 advisory for vendor-supplied technical details.
Detection Methods for CVE-2025-26667
Indicators of Compromise
- Unexpected outbound RRAS or VPN connections originating from Windows Server hosts to untrusted IP addresses.
- Anomalous traffic volumes on RRAS-associated ports (PPTP TCP/1723, L2TP UDP/1701, SSTP TCP/443) that do not correlate with legitimate remote access sessions.
- Windows Event Log entries showing RRAS service errors or repeated malformed protocol messages from external endpoints.
Detection Strategies
- Inspect network flow logs for RRAS traffic patterns that deviate from baseline VPN usage, especially connections initiated by user endpoints to unknown remote servers.
- Correlate user browsing or email click events with subsequent RRAS activity to identify attacker-induced connections.
- Alert on RRAS responses containing unusually large payloads that may indicate memory disclosure.
Monitoring Recommendations
- Enable RRAS accounting and audit logs on all Windows Server hosts running the role and forward them to a centralized SIEM.
- Monitor for the RRAS role being enabled on servers where it is not required, and treat such changes as high-priority events.
- Track patch compliance status for the April 2025 security update across the Windows Server fleet.
How to Mitigate CVE-2025-26667
Immediate Actions Required
- Apply the April 2025 Microsoft security update referenced in the Microsoft Security Update CVE-2025-26667 advisory to every affected Windows Server host.
- Inventory all servers with the Routing and Remote Access role installed and prioritize patching for internet-exposed systems.
- Restrict network access to RRAS endpoints using firewall rules that permit only known VPN client ranges.
Patch Information
Microsoft released security updates addressing CVE-2025-26667 on the April 2025 Patch Tuesday. Refer to the vendor advisory at Microsoft Security Update CVE-2025-26667 for the specific KB articles that correspond to each affected Windows Server version.
Workarounds
- Disable the Routing and Remote Access Service on servers that do not require VPN, dial-up, or routing functionality.
- Block inbound and outbound RRAS protocol ports (TCP/1723, UDP/1701, UDP/500, UDP/4500, TCP/443 SSTP) at the perimeter where remote access is not a business requirement.
- Segment RRAS servers into dedicated network zones and require MFA-backed VPN authentication to limit exposure until patches are deployed.
# Disable the Routing and Remote Access Service on a Windows Server host
Set-Service -Name RemoteAccess -StartupType Disabled
Stop-Service -Name RemoteAccess -Force
# Verify the service state
Get-Service -Name RemoteAccess | Select-Object Name, Status, StartType
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
