CVE-2026-72959: Windows RRAS Remote Code Execution Flaw

CVE-2026-72959 Overview

CVE-2026-72959 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw is classified as a heap-based buffer overflow [CWE-122] and enables an authenticated attacker on the network to execute arbitrary code on a vulnerable host. Successful exploitation grants unauthorized access to the target machine with the privileges of the affected service.

Microsoft assigned a CVSS 3.1 base score of 8.8 and rated the issue High severity. The EPSS model estimates a 0.894% probability of exploitation within 30 days, placing it in the 57th percentile of scored CVEs.

Critical Impact
An attacker with low-level network privileges can achieve full compromise of confidentiality, integrity, and availability on Windows systems running RRAS.

Affected Products

Microsoft Windows with the Routing and Remote Access Service (RRAS) role enabled
Specific affected build numbers are enumerated in the Microsoft Security Update Guide
Windows Server deployments acting as VPN, dial-up, or network routers are within scope

Discovery Timeline

2026-09-08 - CVE-2026-72959 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72959

Vulnerability Analysis

The Routing and Remote Access Service handles VPN, dial-up, and site-to-site routing on Windows Server. CVE-2026-72959 exists in the parsing or processing logic of network-facing RRAS components. An authenticated attacker sends crafted traffic to the service and triggers a heap-based buffer overflow condition. The overflow corrupts adjacent heap structures and allows the attacker to redirect execution flow into attacker-controlled memory. Because RRAS runs with elevated system privileges, code execution results in unauthorized access to the host and any resources reachable from it.

Root Cause

The root cause is a heap-based buffer overflow [CWE-122]. RRAS allocates a heap buffer whose size does not adequately account for attacker-supplied input length. Subsequent copy operations write past the allocation boundary and overwrite adjacent heap metadata or function pointers. Detailed root-cause information is available in the Microsoft Security Update Guide.

Attack Vector

The attack vector is the network. The attacker must have low-level privileges (PR:L) but does not require user interaction. Exploitation involves sending crafted protocol messages to an exposed RRAS endpoint. No public proof-of-concept exploit was available at time of publication. Refer to the vendor advisory for protocol-level details, since no verified exploitation code has been released.

Detection Methods for CVE-2026-72959

Indicators of Compromise

Unexpected crashes or restarts of the RemoteAccess service or svchost.exe instances hosting RRAS
New or unexpected child processes spawned by RRAS service accounts
Outbound network connections initiated from the RRAS host to unfamiliar destinations
Anomalous authentication events preceding RRAS traffic spikes

Detection Strategies

Inspect Windows Event Log for Service Control Manager entries indicating RRAS termination or crash-recovery loops
Correlate authentication events with subsequent inbound RRAS protocol traffic from the same principal
Deploy behavioral endpoint identification to flag process injection or unusual child-process trees originating from RRAS binaries
Baseline normal RRAS packet sizes and alert on outlier payload lengths targeting management interfaces

Monitoring Recommendations

Forward RRAS event logs and process-creation telemetry to a centralized SIEM for retention and correlation
Enable Windows Defender Attack Surface Reduction rules that block child processes from service accounts
Monitor network segments where RRAS is exposed for scanning activity or repeated malformed requests
Alert on any new administrative account creation on RRAS servers following inbound network anomalies

How to Mitigate CVE-2026-72959

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as the primary remediation
Inventory all Windows Server hosts with the RRAS role enabled and prioritize internet-facing systems
Restrict RRAS access to trusted management networks using host and perimeter firewalls
Rotate credentials for any account that could authenticate to RRAS endpoints

Patch Information

Microsoft has published fix information under the CVE identifier in the Security Update Guide. Administrators should consult the Microsoft Security Update Guide to identify the correct cumulative update for each affected Windows build and apply it through standard patch-management channels.

Workarounds

Disable the Routing and Remote Access Service on hosts that do not require VPN or routing functionality
Enforce network segmentation and IPsec authentication for traffic destined to RRAS endpoints
Require VPN or bastion-host connectivity for administrative access rather than exposing RRAS to untrusted networks

bash

# Disable RRAS on Windows Server where the role is not required
Set-Service -Name RemoteAccess -StartupType Disabled
Stop-Service -Name RemoteAccess

# Verify service state
Get-Service -Name RemoteAccess | Select-Object Status, StartType