CVE-2026-69590: Windows RRAS Remote Code Execution Flaw

CVE-2026-69590 Overview

CVE-2026-69590 is a critical remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). An unauthenticated attacker can send crafted network traffic to a vulnerable RRAS endpoint and execute arbitrary code on the target system. The vulnerability is classified as a heap-based buffer overflow under [CWE-122]. Microsoft published the advisory on 2026-09-08, and it was last updated on 2026-09-09.

Critical Impact
Successful exploitation grants full unauthorized access to the victim's machine over the network with no user interaction and no authentication required.

Affected Products

Microsoft Windows systems with the Routing and Remote Access Service (RRAS) role enabled
Windows Server deployments configured as VPN or routing endpoints
Refer to the Microsoft CVE-2026-69590 Advisory for the authoritative list of affected builds

Discovery Timeline

2026-09-08 - CVE-2026-69590 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-69590

Vulnerability Analysis

The flaw resides in the Windows Routing and Remote Access Service (RRAS), a Microsoft component that provides routing, VPN, and dial-up connectivity. RRAS listens on network-reachable interfaces and parses protocol messages from remote clients. The vulnerability enables remote code execution without authentication or user interaction, granting attackers control equivalent to the service's privileges. RRAS typically runs with SYSTEM-level rights, which means successful exploitation results in full host compromise.

Root Cause

The issue is a heap-based buffer overflow [CWE-122] in RRAS request handling. The service allocates a heap buffer sized against attacker-influenced input and then writes past the allocation boundary when processing the crafted message. Corrupting adjacent heap metadata and object pointers allows an attacker to hijack control flow and redirect execution to attacker-supplied payloads.

Attack Vector

Exploitation is performed remotely over the network against an exposed RRAS endpoint. The attacker sends a specially crafted protocol message that triggers the overflow during parsing. Because RRAS is commonly published on internet-facing interfaces for VPN and site-to-site routing, vulnerable hosts are directly reachable in many deployments. No credentials and no user interaction are required.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.976%. Refer to the Microsoft CVE-2026-69590 Advisory for protocol-level technical details.

Detection Methods for CVE-2026-69590

Indicators of Compromise

Unexpected crashes or restarts of the RemoteAccess service or svchost.exe hosting RRAS
New child processes spawned by the RRAS service, particularly cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections initiated by the RRAS service host to unfamiliar external addresses
Anomalous inbound traffic volume to RRAS listening ports from untrusted networks

Detection Strategies

Monitor Windows Event Logs for RRAS service faults, exception codes, and Windows Error Reporting (WER) entries referencing svchost.exe
Alert on process lineage where the RRAS service host spawns interactive shells or scripting engines
Deploy network signatures on perimeter sensors that flag malformed RRAS/PPTP/L2TP protocol traffic
Baseline RRAS listener activity and alert on deviations in packet size distribution or connection patterns

Monitoring Recommendations

Enable verbose RRAS logging and forward events to a centralized SIEM for correlation
Track authentication and connection attempts to VPN endpoints for volume anomalies
Continuously inventory hosts exposing RRAS to the internet and prioritize them for patching
Correlate endpoint telemetry with network flow data to identify post-exploitation lateral movement from RRAS servers

How to Mitigate CVE-2026-69590

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-69590 Advisory to all Windows Server systems running RRAS
Identify every host with the Routing and Remote Access role enabled and prioritize internet-facing servers first
Restrict inbound access to RRAS ports at the perimeter firewall to known VPN client ranges
Increase monitoring on RRAS hosts until patches are fully deployed and validated

Patch Information

Microsoft has published fixes through the Update Guide. Administrators should consult the Microsoft CVE-2026-69590 Advisory for the specific KB articles and cumulative updates that correspond to each supported Windows Server version. Install the update, reboot the host, and confirm the RRAS service returns to a healthy state before returning the system to production traffic.

Workarounds

Disable the Routing and Remote Access Service on hosts that do not require it using Set-Service -Name RemoteAccess -StartupType Disabled
Block inbound traffic to RRAS protocol ports (for example, TCP/1723 for PPTP and UDP/500 and UDP/4500 for IKE/IPsec) from untrusted networks
Place RRAS endpoints behind a hardened VPN concentrator or reverse proxy that enforces protocol validation
Segment RRAS servers on isolated network zones to limit lateral movement if compromise occurs

bash

# Disable RRAS on Windows hosts that do not require the role
Set-Service -Name RemoteAccess -StartupType Disabled
Stop-Service -Name RemoteAccess -Force

# Restrict inbound PPTP access at the Windows firewall
New-NetFirewallRule -DisplayName "Block-RRAS-PPTP-Inbound" `
  -Direction Inbound -Protocol TCP -LocalPort 1723 -Action Block