CVE-2026-69852 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

CVE-2026-69852 is a Critical remote code execution vulnerability in Windows Routing and Remote Access Service (RRAS). It is caused by a heap-based buffer overflow. An attacker with low privileges could potentially exploit the vulnerability over a network without requiring user interaction. Successful exploitation has high attack complexity and is not guaranteed, but could result in unauthorized access with high impact to confidentiality, integrity, and availability. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 7.5.

SEVERITY: Critical.

THREAT: The vulnerability presents a network-based remote code execution threat. Successful exploitation requires low privileges and no user interaction, but the attack complexity is high and depends on factors such as system configuration, environment, and existing security measures. A successful attack could compromise the confidentiality, integrity, and availability of the affected system.

EXPLOITS: There is no confirmed public disclosure or known exploitation. Exploit code maturity is classified as Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-69852 is a heap-based buffer overflow, identified as CWE-122, affecting Windows Routing and Remote Access Service (RRAS). The attack vector is network-based, with low privileges required and no user interaction. Exploitation requires high attack complexity and a deep understanding of the target system, with success potentially depending on environmental and configuration factors. If successfully exploited, the flaw allows remote code execution and unauthorized access to the victim’s machine, with high potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. Relevant 32-bit, x64, and ARM64 editions are affected as specified for each Windows release. Exploitation is assessed as “Exploitation More Likely” and requires network access, low privileges, high attack complexity, and no user interaction.

BUSINESS IMPACT: Successful exploitation could allow an attacker to gain unauthorized access and execute code on an affected Windows machine. Because confidentiality, integrity, and availability impacts are all rated High, compromise could expose sensitive information, enable unauthorized system changes, and disrupt affected services or systems. For organizations running RRAS on affected Windows platforms, a successful attack could turn a remotely reachable weakness into a significant system compromise.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so affected systems should be updated with the applicable security update.

URGENCY: This vulnerability is rated Critical and could lead to remote code execution with high confidentiality, integrity, and availability impacts. Although exploitation is not currently reported and exploit code maturity is Unproven, exploitation is assessed as more likely. Organizations should prioritize deployment of the applicable security updates, particularly on affected systems running RRAS.