CVE-2026-62819 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

CVE-2026-62819 is a critical use-after-free vulnerability (CWE-416) in Windows Routing and Remote Access Service (RRAS). An unauthenticated remote attacker could send a specially crafted packet to an affected service and, after successfully winning a race condition, execute code on the target system. The attack requires no privileges and no user interaction, although exploitation has high attack complexity.

CVSS Score: 8.1.

SEVERITY: Critical.

THREAT:
The vulnerability can be attacked over the network and has the potential to provide unauthorized remote code execution on an affected system. Successful exploitation carries high confidentiality, integrity, and availability impact. Exploitation requires the attacker to win a race condition, which contributes to the high attack complexity.

EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Its exploitability assessment is “Exploitation Less Likely,” and exploit code maturity is Unproven. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept (PoC) exploitation.

TECHNICAL SUMMARY:
CVE-2026-62819 is caused by a use-after-free weakness in Windows Routing and Remote Access Service (RRAS). An unauthenticated attacker can send a specially crafted packet to an affected service over the network. Successful exploitation requires winning a race condition and can result in attacker-controlled code executing on the target system. The CVSS metrics identify a network attack vector, high attack complexity, no required privileges, no required user interaction, unchanged scope, and high impact to confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 24H2, 25H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including the listed Server Core installations and applicable architectures. Exploitation is remote through a specially crafted network packet and requires winning a race condition.

BUSINESS IMPACT:
Successful exploitation could allow an attacker to execute code remotely on an affected system without authentication or user interaction. This creates potentially serious consequences for organizations because confidentiality, integrity, and availability can all be impacted at a high level, potentially exposing sensitive information, allowing unauthorized changes, or disrupting affected systems and services.

WORKAROUND:
No workaround or mitigation is specified. An official fix is identified as the remediation, so affected systems should receive the applicable security update.

URGENCY:
This vulnerability is rated Critical and enables remote code execution without privileges or user interaction. Although exploitation is assessed as less likely and no active exploitation is identified, the potential impact is high across confidentiality, integrity, and availability. Prioritize deployment of the applicable security update across affected Windows systems.