CVE-2026-70570 Overview
CVE-2026-70570 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw stems from a use-after-free condition [CWE-416] in the RRAS component. An attacker on an adjacent network can exploit the issue to execute arbitrary code and gain unauthorized access to a targeted machine. Microsoft published the advisory on 2026-09-08, and the record was last updated on 2026-09-09. The EPSS score is 0.423% with a percentile of 35.699 as of 2026-09-10.
Critical Impact
Successful exploitation grants remote code execution on hosts running RRAS, exposing confidentiality, integrity, and availability of the target system.
Affected Products
- Microsoft Windows with Routing and Remote Access Service (RRAS) enabled
- Refer to the Microsoft Security Update Guide for the authoritative list of affected builds
- Systems acting as RRAS servers on adjacent network segments
Discovery Timeline
- 2026-09-08 - CVE-2026-70570 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-70570
Vulnerability Analysis
The vulnerability resides in the Windows Routing and Remote Access Service, a component that provides routing, VPN, and dial-up remote access functionality. The defect is a use-after-free condition, classified under [CWE-416]. An attacker positioned on an adjacent network can send crafted traffic to a vulnerable RRAS endpoint. Processing that traffic causes the service to reference memory that has already been released. Controlling the freed allocation lets the attacker steer execution flow and run arbitrary code in the context of the RRAS service.
The attack requires no authentication and no user interaction. Attack complexity is high, reflecting the timing and heap-grooming steps needed to reliably trigger the free-then-use sequence. Successful exploitation compromises the host and can serve as a pivot into the internal network.
Root Cause
The root cause is an object lifetime management error in RRAS. A code path releases a heap object while another path retains a reference to it. Subsequent operations dereference the stale pointer, allowing memory contents controlled by the attacker to influence execution.
Attack Vector
The attack vector is Adjacent Network. The attacker must reach the RRAS service over a network segment shared with the target, such as the same broadcast domain, VPN link, or logical layer-2 segment. No credentials are required. Exploitation triggers when specially crafted protocol messages are processed by the vulnerable RRAS handler.
No public proof-of-concept code is available for CVE-2026-70570. See the Microsoft Security Update Guide for vendor technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-70570
Indicators of Compromise
- Unexpected crashes or restarts of the RemoteAccess service or svchost.exe hosting RRAS
- New child processes spawned by the RRAS service context that do not match a known baseline
- Anomalous outbound connections originating from an RRAS host shortly after inbound adjacent-network traffic
Detection Strategies
- Monitor Windows Error Reporting and crash dumps for faults in RRAS binaries indicating memory corruption
- Inspect network telemetry for malformed RRAS protocol traffic sourced from adjacent segments
- Correlate RRAS service restarts with subsequent authentication or lateral movement events on the same host
Monitoring Recommendations
- Enable process creation auditing (Event ID 4688) on RRAS servers and alert on unusual children of the RRAS service
- Collect and centralize Windows Security, System, and RRAS operational logs for anomaly analysis
- Baseline expected RRAS peers and alert on new adjacent-network sources initiating RRAS sessions
How to Mitigate CVE-2026-70570
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all systems running RRAS
- Inventory Windows hosts with the Routing and Remote Access role enabled and prioritize patching internet-adjacent and VPN concentrator systems
- Restrict adjacent-network exposure of RRAS endpoints through segmentation and access control lists
Patch Information
Microsoft has issued a security update addressing CVE-2026-70570. Administrators should consult the Microsoft Security Update Guide for the specific KB articles and build numbers that apply to their Windows versions, then deploy through Windows Update, WSUS, or their standard patch management pipeline.
Workarounds
- Disable the Routing and Remote Access Service on hosts that do not require it
- Limit RRAS listeners to trusted network interfaces and enforce firewall rules that block untrusted adjacent traffic
- Place RRAS servers behind network segmentation that restricts layer-2 reach to authorized clients only
# Disable the Routing and Remote Access service where not required
sc.exe config RemoteAccess start= disabled
sc.exe stop RemoteAccess
# Verify service state
sc.exe query RemoteAccess
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
