CVE-2026-70570 in Windows
Summary
by MITRE • 09/09/2026
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability described constitutes a critical remote code execution flaw within the Microsoft Windows Routing and Remote Access Service, commonly referred to as RRAS. This service is designed to provide routing services for both IP and non-IP networks, allowing organizations to connect multiple network segments together or enable remote users to access corporate resources via dial-up or virtual private networks. The core technical issue lies in how RRAS processes specific packets during the authentication and connection establishment phases. Specifically, an attacker can craft maliciously formatted data that exploits a memory corruption error within the service's handling of routing protocols or authentication headers. When the vulnerable component parses this specially crafted input, it fails to properly validate buffer boundaries or handle pointer arithmetic correctly, leading to arbitrary code execution in the context of the operating system kernel or high-privilege user account associated with the RRAS process. This type of flaw is typically categorized under CWE-120 Buffer Overflow without bounds checking or CWE-787 Out-of-bounds Write, depending on the specific memory manipulation involved. The exploitation allows an unauthenticated attacker to execute arbitrary code on the target system by sending a single crafted packet over the network, leveraging the inherent trust that RRAS places in incoming connection requests from remote clients.
The operational impact of this vulnerability is severe due to its potential for full system compromise without any user interaction or prior authentication credentials. Since RRAS often runs with elevated privileges to manage network interfaces and routing tables, successful exploitation grants the attacker complete control over the affected machine. This includes the ability to install programs, view, change, or delete data, and create new accounts with full administrative rights. Furthermore, because RRAS is frequently deployed as a gateway for remote access, this vulnerability can serve as an initial entry point into larger internal networks. Attackers can leverage the compromised host to pivot laterally across the network, accessing sensitive resources such as databases, file shares, or other critical infrastructure components that are not directly exposed to the internet but are reachable from the RRAS server's internal interface. This significantly expands the attack surface and increases the potential for data exfiltration, ransomware deployment, or persistent backdoor installation within the enterprise environment.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to initial access and privilege escalation. Specifically, it maps to T1190 Exploit Public-Facing Application, as RRAS is often exposed to external networks to facilitate remote work or branch office connectivity. The exploitation method also relates to T1059 Command and Scripting Interpreter if the attacker executes scripts post-exploitation, and potentially T1068 Privilege Escalation for gaining higher system rights. Understanding these mappings helps security teams prioritize detection rules and incident response procedures based on known adversary behaviors associated with similar vulnerabilities in network services.
Mitigation strategies must focus on immediate patching and network segmentation to reduce exposure. The primary remediation is the application of the latest Microsoft Security Update that addresses this specific flaw within the RRAS component. Organizations should verify their systems against the official vendor advisory and apply patches promptly, prioritizing servers that are directly accessible from untrusted networks such as the internet or public Wi-Fi environments. In addition to patching, network-level controls should be implemented to restrict access to RRAS ports, typically TCP port 1723 for PPTP connections, using firewalls or Access Control Lists (ACLs) to allow only authorized IP addresses or subnets. Enforcing strong authentication mechanisms and disabling unnecessary routing protocols can further reduce the attack surface. Regular vulnerability scanning and penetration testing should be conducted to identify any unpatched instances of RRAS in production environments, ensuring that no legacy systems remain vulnerable to this critical remote code execution risk.