CVE-2026-85809 in Windows
Summary
by MITRE • 10/14/2026
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified within the Microsoft Windows Routing and Remote Access Service, commonly referred to as RRAS, represents a critical remote code execution flaw that fundamentally compromises the integrity of network infrastructure. This service is designed to provide routing services for both IP and non-IP networks, allowing organizations to connect multiple local area networks together or enable dial-up access for remote users. The core technical deficiency lies in how the RRAS component processes specific packets during the authentication and connection establishment phases. Specifically, an attacker can craft maliciously formatted network traffic that exploits improper input validation within the service's handling of routing protocols or authentication handshakes. When the vulnerable system receives this specially crafted data, it fails to adequately sanitize or validate the inputs before processing them in memory. This lack of rigorous boundary checking allows for a buffer overflow condition or similar memory corruption mechanism, which disrupts normal program flow and enables the execution of arbitrary code at the highest privilege levels available to the service account.
From an operational perspective, the impact of this vulnerability is severe because RRAS typically runs with high-level system privileges on Windows Server operating systems. An attacker who successfully exploits this flaw does not merely gain limited user access but achieves full control over the affected machine. This unauthorized access allows for the installation of malware, the creation of new administrative accounts to maintain persistence, and the exfiltration or modification of sensitive data stored on the server. Furthermore, because RRAS often serves as a gateway between internal networks and external connections, compromising this service can provide an attacker with a foothold deep within the corporate network perimeter. This position facilitates lateral movement, allowing the threat actor to pivot from the compromised router to other critical systems such as domain controllers, file servers, or database engines that rely on RRAS for connectivity. The ability to execute code remotely without user interaction makes this vulnerability particularly dangerous in environments where automated connections are established frequently.
In terms of industry-standard classification frameworks, this vulnerability aligns with Common Weakness Enumeration identifier CWE-120, which describes buffer copy without checking size limits, often leading to memory corruption and arbitrary code execution. Additionally, the exploitation technique maps directly to MITRE ATT&CK tactic T1190, defined as Exploit Public-Facing Application, where adversaries leverage vulnerabilities in internet-facing services to gain initial access. The attack vector is classified under network-based remote exploitation, requiring no physical proximity or local user interaction, which significantly increases its exploitability score and risk profile. Security researchers have noted that the complexity of exploiting this flaw may vary depending on specific patch levels and configuration settings, but the potential for automated worm-like propagation remains a significant concern if left unpatched in exposed environments.
Mitigation strategies must prioritize immediate remediation through official vendor updates. Organizations running affected versions of Windows Server should apply the latest security patches released by Microsoft to address the underlying memory handling defects within the RRAS service. In scenarios where patching is not immediately feasible due to operational constraints, network segmentation and firewall rules should be implemented to restrict access to RRAS ports from untrusted networks. Specifically, limiting inbound connections on TCP port 1723 for PPTP or UDP/TCP ports associated with L2TP/IPsec can reduce the attack surface. Additionally, disabling unnecessary routing protocols if they are not actively used in the network architecture serves as a robust defense-in-depth measure. Regular vulnerability scanning and continuous monitoring of RRAS logs for anomalous connection attempts are essential components of an ongoing security posture to detect potential exploitation attempts before successful compromise occurs.