CVE-2026-72939: Windows RRAS Null Pointer DOS Vulnerability

CVE-2026-72939 Overview

CVE-2026-72939 is a null pointer dereference vulnerability in the Windows Routing and Remote Access Service (RRAS). An authorized attacker with network access can trigger the flaw to cause a denial-of-service condition on the affected host. The weakness is classified under [CWE-476] and impacts availability without affecting confidentiality or integrity.

Critical Impact
An authenticated network-based attacker can crash the RRAS component, disrupting VPN, dial-up, and site-to-site routing services on affected Windows systems.

Affected Products

Microsoft Windows systems running the Routing and Remote Access Service (RRAS) role
Refer to the Microsoft Security Update CVE-2026-72939 advisory for the current list of affected builds
Environments exposing RRAS endpoints to untrusted networks

Discovery Timeline

2026-09-08 - CVE-2026-72939 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-72939

Vulnerability Analysis

The Routing and Remote Access Service handles routing, VPN, and remote access connectivity on Windows Server hosts. The service exposes network-facing components that process protocol messages from authenticated clients. When RRAS processes a malformed or unexpected input, a code path dereferences a pointer that has not been validated against NULL.

The resulting access violation terminates the RRAS process, breaking active tunnels and remote access sessions. Because the flaw affects availability only, attackers cannot use it to read memory, escalate privileges, or execute code. The EPSS model estimates a 1.139% probability of exploitation within 30 days.

Root Cause

The root cause is a missing null check on a pointer used during request handling within RRAS. Under attacker-controlled conditions, the pointer resolves to NULL and subsequent dereference triggers an unhandled exception. This corresponds to [CWE-476: NULL Pointer Dereference].

Attack Vector

Exploitation requires network reachability to the RRAS service and valid low-privileged credentials. The attacker sends a crafted request across the network to reach the vulnerable code path. No user interaction is required. Successful exploitation crashes the service and denies remote access functionality until restart.

No public proof-of-concept is available. Technical details are limited to the vendor advisory. Refer to the Microsoft Security Update CVE-2026-72939 for authoritative information.

Detection Methods for CVE-2026-72939

Indicators of Compromise

Unexpected termination or repeated restart of the RemoteAccess service on Windows hosts running RRAS
Windows Application or System event log entries showing svchost.exe or RasMan crashes with access violation exception codes such as 0xC0000005
Dropped VPN and dial-up sessions correlated with inbound network traffic to RRAS listener ports

Detection Strategies

Correlate service crash events with authenticated network sessions to RRAS from unusual source addresses or accounts
Monitor Windows Error Reporting entries and WER dumps referencing RRAS modules for repeated faults
Alert on anomalous connection patterns to RRAS management and tunneling ports from low-privilege user accounts

Monitoring Recommendations

Forward Windows Application, System, and Security event logs from RRAS servers to a centralized log platform
Track service availability metrics for RemoteAccess and generate alerts on unplanned restarts
Baseline authenticated RRAS client behavior to identify sessions that consistently precede service failures

How to Mitigate CVE-2026-72939

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-72939 advisory
Inventory Windows Servers with the Routing and Remote Access role enabled and prioritize internet-facing systems
Restrict RRAS access to trusted management networks until patching is complete

Patch Information

Microsoft has published guidance and updates for CVE-2026-72939 through the Microsoft Security Response Center. Consult the Microsoft Security Update CVE-2026-72939 page for the specific KB articles and build numbers that address the null pointer dereference.

Workarounds

Disable the Routing and Remote Access Service on hosts that do not require VPN or routing functionality
Enforce network segmentation and firewall rules to limit RRAS exposure to authorized clients only
Require strong authentication and monitor account usage to reduce the pool of actors who can reach the vulnerable code path

bash

# Query RRAS service status and disable if not required
Get-Service -Name RemoteAccess
Set-Service -Name RemoteAccess -StartupType Disabled
Stop-Service -Name RemoteAccess