CVE-2026-85792: Windows RRAS Remote Code Execution Vulnerability

CVE-2026-85792 Overview

CVE-2026-85792 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). An unauthenticated attacker can exploit the flaw over the network to gain unauthorized access to the target system. The underlying weakness is a use-after-free condition tracked as [CWE-416], which allows memory corruption during RRAS request processing.

The vulnerability requires no authentication, no user interaction, and no elevated privileges. Successful exploitation grants the attacker control over the affected host, including confidentiality, integrity, and availability of system resources.

Critical Impact
Unauthenticated remote attackers can execute arbitrary code on Windows systems running the RRAS role, leading to full system compromise.

Affected Products

Microsoft Windows systems with the Routing and Remote Access Service (RRAS) role enabled
Refer to the Microsoft CVE-2026-85792 Update Guide for the full list of affected Windows versions
Windows Server deployments configured as VPN, dial-up, or site-to-site routing endpoints

Discovery Timeline

2026-10-13 - CVE-2026-85792 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in the NVD database

Technical Details for CVE-2026-85792

Vulnerability Analysis

The vulnerability resides in the Windows Routing and Remote Access Service, a component that supports VPN connections, dial-up networking, and multiprotocol routing. RRAS listens on network interfaces and parses complex protocol structures, which expands its attack surface.

The flaw is classified as a use-after-free weakness [CWE-416]. The service references a memory object after it has been released, allowing an attacker to influence the contents of that freed region. When the dangling pointer is dereferenced, controlled data can redirect execution flow.

Because RRAS runs with elevated service privileges, successful exploitation yields code execution in a high-privilege context. An attacker reaching the service over the network does not need valid credentials or user interaction to trigger the condition.

Root Cause

The root cause is improper lifetime management of a heap object within RRAS request handling. The service frees an allocation while another code path retains a reference to the same memory. Subsequent operations on the stale pointer corrupt heap state and enable arbitrary code execution.

Attack Vector

The attack vector is network-based. An attacker sends crafted traffic to a reachable RRAS endpoint and triggers the use-after-free condition during protocol parsing. Internet-exposed VPN or routing endpoints are the most immediate targets, but any accessible RRAS instance on a reachable network segment is in scope.

No verified public proof-of-concept exploit was available at the time of publication. See the Microsoft CVE-2026-85792 Update Guide for vendor-authoritative technical details.

Detection Methods for CVE-2026-85792

Indicators of Compromise

Unexpected crashes, restarts, or memory faults in the RemoteAccess or RasMan service processes
Anomalous inbound traffic to RRAS listening ports from untrusted sources, including PPTP (TCP 1723), L2TP (UDP 1701), and SSTP (TCP 443) when RRAS binds that port
New or unexpected child processes spawned by RRAS service accounts, especially command interpreters such as cmd.exe or powershell.exe
Outbound connections initiated by the RRAS service process to unfamiliar external hosts

Detection Strategies

Monitor Windows Event Logs for RRAS service crashes, Windows Error Reporting entries, and application faults referencing RRAS modules
Correlate network telemetry showing malformed or oversized RRAS protocol traffic with host-level service instability
Apply behavioral detection rules that flag code execution originating from the RRAS service account outside of its normal process tree

Monitoring Recommendations

Enable detailed logging on the RemoteAccess service and forward events to a centralized SIEM for correlation
Baseline normal RRAS traffic volume and alert on sudden spikes or protocol anomalies
Audit the inventory of hosts running the RRAS role and ensure each is covered by endpoint telemetry

How to Mitigate CVE-2026-85792

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-85792 Update Guide as soon as it becomes available in your environment
Identify every Windows Server with the Routing and Remote Access role installed and prioritize patching of internet-facing instances
Restrict inbound access to RRAS endpoints to known VPN clients and management networks using firewall rules

Patch Information

Microsoft addresses CVE-2026-85792 through its monthly security update channel. Consult the Microsoft CVE-2026-85792 Update Guide to identify the correct update package for each affected Windows version and deploy through Windows Update, WSUS, or your enterprise patch management platform.

Workarounds

Disable the Routing and Remote Access Service on hosts that do not require VPN or routing functionality
Place RRAS endpoints behind a dedicated perimeter firewall and limit exposure to authenticated client source ranges where possible
Segment RRAS servers from sensitive internal networks to reduce the blast radius if the service is compromised

bash

# Example: disable the RRAS service on hosts that do not need it
sc.exe config RemoteAccess start= disabled
sc.exe stop RemoteAccess