CVE-2026-72959 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

This critical vulnerability is a heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS). An authenticated attacker with low-level access can send a specially crafted request to an affected server and potentially execute code. The attack can be performed over the network with low complexity and requires no user interaction.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker with low-level authenticated access could target RRAS remotely using a specially crafted request. Successful exploitation could compromise confidentiality, integrity, and availability, each of which is rated High in the CVSS metrics.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit Code Maturity is Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-72959 is a heap-based buffer overflow (CWE-122) affecting Windows Routing and Remote Access Service. An authenticated attacker with low privileges can send a specially crafted request over the network to an affected server. The vulnerability has low attack complexity, requires no user interaction, and can result in remote code execution. Successful exploitation can have a high impact on confidentiality, integrity, and availability. An official fix is identified in the source.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable architectures. Exploitation requires authenticated low-level access and a specially crafted network request; no user interaction is required.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on an affected server, potentially exposing sensitive information, enabling unauthorized changes, and disrupting system availability. For organizations operating affected RRAS systems, a compromised server could create significant security and operational consequences.

WORKAROUND: No mitigations or workarounds are identified. The source identifies an official fix, and affected software entries indicate that a restart is required.

URGENCY: This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Its network-based, low-complexity attack path and lack of required user interaction increase the potential impact. Although exploitation is assessed as Less Likely and no exploitation is reported, affected systems should receive the applicable security update with high priority.