External risk intelligence

Windows RRAS Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72950

The Windows Routing and Remote Access Service (RRAS) is a service specifically designed to provide remote connectivity, VPN services, and network routing. It is intended to be internet-facing by design to facilitate remote access for users and network bridging, making it a common public-facing edge service in standard deployment patterns.

Remote Code Execution

Microsoft Windows 10 1607

before 10.0.14393.9512before 10.0.17763.9245before 10.0.19044.7725before 10.0.19045.7725before 10.0.22631.7582before 10.0.26100.9445before 10.0.26200.9445before 10.0.28000.2954r2b...

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Microsoft Windows' Routing and Remote Access Service (RRAS). This issue could allow an unauthenticated attacker to execute arbitrary code on a victim's machine remotely. The Routing and Remote Access Service is often exposed externally to enable remote connectivity and VPN services.

Remote access service allows code execution.
External exposure makes it a significant risk.
Confirm relevance and assess exposure impact.

Attack Path

How an attacker could exploit the issue

An attacker can reach a vulnerable Windows Routing and Remote Access Service (RRAS) over the network without any special privileges. By interacting with this service, an attacker can trigger a flaw that leads to their code running on the victim's machine. This can allow them to take control of the system.

Network access is required.
Attacker triggers vulnerability in RRAS.
Unauthorized code execution on the machine.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Windows Routing and Remote Access Service could allow an attacker to gain unauthorized remote code execution. This could occur when the service is configured to allow remote access, potentially affecting system integrity and availability.

System data and configuration at risk.
Unauthorized remote code execution.
Compromise of system integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Windows Routing and Remote Access Service (RRAS) is a critical edge service, often internet-facing, making its compromise a high priority. Infrastructure or platform teams are typically responsible for managing this service, alongside network and security teams who oversee its exposure. The first actionable step is to identify all instances of RRAS, confirm their reachability and business criticality, and then engage the accountable owner to prioritize and plan remediation based on the identified risk.

Identify RRAS deployment and owners.
Verify external reachability and impact.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Windows Routing and Remote Access Service?

The Routing and Remote Access Service (RRAS) is a built-in Windows component that enables network connectivity and management features. It is primarily used to provide VPN services, direct remote access for users, and network routing between different subnets. Because it functions as a gateway for remote connections, it is often configured to be accessible from outside the local network.

What does CVE-2026-72950 mean for my system?

CVE-2026-72950 is a Remote Code Execution (RCE) vulnerability classified under CWE-122, which involves a heap-based buffer overflow weakness. This flaw allows an attacker to send specially crafted network requests to the RRAS component. If successful, the attacker can execute arbitrary commands on the target machine with the privileges of the service, potentially gaining full control over the affected system.

How is this vulnerability triggered?

An attacker triggers this vulnerability by sending malicious network traffic to an active RRAS instance. Because the flaw exists within the service itself, it does not require the attacker to have user credentials or any special prior access to the machine. Note that if the RRAS service is completely disabled or not running on a specific machine, the system is not vulnerable to this network-based attack path.

Is my system at risk according to Halo Surface Signal?

Yes, if you run RRAS, you should consider this a priority. Halo Surface Signal identifies RRAS as a service designed for remote connectivity, meaning it is often exposed to the internet by default to facilitate VPN or bridging functions. Because the attack vector for CVE-2026-72950 is network-based, systems with an internet-facing RRAS configuration are at a higher risk of being reached and exploited by remote actors.

What should I do first to address this?

Your first step is to perform an inventory of your environment to identify all servers or machines running the RRAS service. Once identified, verify which instances are reachable from the internet versus those limited to internal networks. After assessing the exposure, coordinate with your infrastructure or system administration teams to prioritize and apply the necessary security updates from Microsoft to patch the underlying service vulnerability.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72950

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.