CVE-2026-85809: Windows RRAS Remote Code Execution Vulnerability

CVE-2026-85809 Overview

CVE-2026-85809 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). An unauthenticated attacker can send crafted network traffic to a vulnerable RRAS endpoint and execute code in the context of the service. The weakness is tracked under CWE-122 (Heap-based Buffer Overflow), indicating memory corruption on the heap during request processing. Microsoft published the advisory in October 2026 and the issue affects Windows systems with RRAS enabled, commonly used for VPN concentration and site-to-site routing.

Critical Impact
Unauthenticated network attackers can gain full control of Windows servers running RRAS, enabling lateral movement into internal networks protected by the affected VPN gateway.

Affected Products

Microsoft Windows Server with Routing and Remote Access Service (RRAS) role enabled
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds

Discovery Timeline

2026-10-13 - CVE-2026-85809 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-85809

Vulnerability Analysis

The Routing and Remote Access Service handles VPN, dial-up, and routing protocols on Windows Server. CVE-2026-85809 is a heap-based buffer overflow [CWE-122] in RRAS request handling. An attacker reaches the vulnerable code path over the network without authentication or user interaction.

Successful exploitation corrupts heap metadata or adjacent objects, allowing the attacker to redirect execution. Because RRAS runs with high privileges, the attacker gains code execution sufficient to install tools, create accounts, and pivot into the internal network. The EPSS score of 0.928% reflects early scoring; this value typically climbs once a public proof of concept appears.

Root Cause

The root cause is improper validation of a length or size field during the parsing of an attacker-controlled RRAS protocol message. The service allocates a heap buffer based on one value and copies data using another, writing past the allocation boundary. Overflowing heap chunks corrupts in-flight structures used by RRAS and allows control-flow hijack when corrupted pointers are later dereferenced.

Attack Vector

The attack vector is purely network-based. An attacker sends a crafted packet to an exposed RRAS listener, typically reachable over VPN protocols such as PPTP, L2TP, SSTP, or IKEv2 on the public edge. No credentials and no user action are required. Internet-exposed RRAS hosts and gateways reachable from untrusted network segments carry the highest risk.

No verified public exploit code is available at the time of writing. See the Microsoft Security Update Guide entry for CVE-2026-85809 for authoritative technical details.

Detection Methods for CVE-2026-85809

Indicators of Compromise

Unexpected crashes or restarts of the RemoteAccess service or svchost.exe instances hosting RRAS
Child processes spawned by the RRAS service process, especially cmd.exe, powershell.exe, or rundll32.exe
New or modified RRAS configuration entries under HKLM\SYSTEM\CurrentControlSet\Services\RemoteAccess
Outbound connections from the RRAS host to unknown external IP addresses shortly after inbound VPN traffic

Detection Strategies

Monitor Windows Error Reporting and Application event logs for faults in modules associated with RRAS, including mprdim.dll, rasmans.dll, and iprtrmgr.dll
Alert on process lineage anomalies where the RRAS service process creates interactive or scripting binaries
Inspect VPN protocol traffic for malformed PPTP, L2TP, SSTP, or IKEv2 messages, including oversized length fields and unusual option combinations

Monitoring Recommendations

Enable verbose RRAS tracing on exposed gateways and forward logs to a centralized analytics platform
Baseline normal VPN client behavior and alert on protocol anomalies or sudden spikes in handshake failures
Track external exposure of RRAS endpoints through continuous attack surface management

How to Mitigate CVE-2026-85809

Immediate Actions Required

Apply the Microsoft security update referenced in the Security Update Guide for CVE-2026-85809 as soon as possible
Inventory all Windows Servers with the RRAS role enabled and prioritize internet-facing systems
Restrict inbound VPN protocols to known client source ranges where feasible
Review authentication, process, and network logs on RRAS hosts for signs of prior exploitation

Patch Information

Microsoft has released a security update that addresses the heap-based buffer overflow in the RRAS component. Refer to the Microsoft Security Update Guide for CVE-2026-85809 for the specific KB article and build numbers that apply to each affected Windows Server version.

Workarounds

Disable the Routing and Remote Access service on hosts that do not require it using Set-Service RemoteAccess -StartupType Disabled followed by Stop-Service RemoteAccess
Block affected VPN protocol ports at the perimeter firewall when RRAS is not in production use, including TCP/1723 (PPTP), UDP/500 and UDP/4500 (IKEv2/L2TP), and TCP/443 (SSTP) where appropriate
Place RRAS gateways behind an upstream filtering device that validates VPN protocol structure

bash

# Disable RRAS on hosts that do not require it
Set-Service -Name RemoteAccess -StartupType Disabled
Stop-Service -Name RemoteAccess

# Verify the service is stopped and disabled
Get-Service -Name RemoteAccess | Select-Object Name, Status, StartType