CVE-2026-72950 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

CVE-2026-72950 is a critical heap-based buffer overflow vulnerability in Windows Routing and Remote Access Service (RRAS). An authenticated attacker with low-level access can send a specially crafted network request to an affected server and execute code without requiring user interaction. The vulnerability has not been publicly disclosed or exploited, and its exploitation assessment is Exploitation Unlikely.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability presents a remote code execution threat over the network. Attack complexity is low, and successful exploitation can have a high impact on confidentiality, integrity, and availability. An attacker must already have low-level authenticated access, but no user interaction is required.

EXPLOITS: Exploited: No. Publicly Disclosed: No. Exploit Code Maturity is Unproven, and the exploitability assessment is Exploitation Unlikely. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-72950 is caused by a heap-based buffer overflow (CWE-122) in Windows Routing and Remote Access Service (RRAS). An authenticated attacker with low-level access to an affected server can send a specially crafted request over the network to trigger the vulnerability and execute code on the server. Attack complexity is rated Low, privileges required are Low, and no user interaction is necessary. Successful exploitation can have a high impact on the confidentiality, integrity, and availability of the affected system.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and applicable architectures. Exploitation requires an authenticated attacker with low-level access to send a specially crafted request to the affected server.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution on affected systems. Because confidentiality, integrity, and availability impacts are all rated High, exploitation could expose sensitive information, enable unauthorized modification of system resources, and disrupt affected services. This makes vulnerable RRAS systems a significant security concern even though exploitation has not been observed.

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified in the source, so affected systems should be updated using the applicable security update.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Its network attack vector, low attack complexity, and lack of required user interaction increase the potential exposure of affected systems. Although exploitation is currently assessed as unlikely and no exploitation is reported, organizations should prioritize deployment of the applicable security updates because successful exploitation could result in remote code execution with high confidentiality, integrity, and availability impacts.