CVE-2026-69590 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

CVE-2026-69590 is a critical heap-based buffer overflow vulnerability in Windows Routing and Remote Access Service (RRAS). An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The attack has low complexity and requires neither privileges nor user interaction.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability presents a significant remote code execution threat because an attacker can target an affected RRAS service over the network without authentication. Successful exploitation could compromise the confidentiality, integrity, and availability of the affected system.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69590 is a heap-based buffer overflow (CWE-122) affecting Windows Routing and Remote Access Service (RRAS). An unauthenticated attacker can trigger the vulnerability by sending a specially crafted packet to an affected service over the network. The attack vector is network-based, attack complexity is low, privileges are not required, and no user interaction is necessary. Successful exploitation can allow remote code execution on the target and can have a high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. An unauthenticated attacker can exploit an affected service by sending a specially crafted network packet.

BUSINESS IMPACT: Successful exploitation could give an attacker unauthorized ability to execute code on a vulnerable Windows system. For organizations, this creates the potential for serious system compromise affecting sensitive information, system integrity, and service availability. Because exploitation requires no authentication or user action, exposed vulnerable services can represent a particularly important attack surface.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8 and enables unauthenticated remote code execution with low attack complexity. Although exploitation is assessed as Less Likely and no exploitation is reported, the combination of network reachability, no required privileges, and no required user interaction makes timely deployment important.