External risk intelligence

Windows RRAS Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-85809

The vulnerability affects the Windows Routing and Remote Access Service (RRAS), which is a remote access service designed to facilitate network connectivity and VPN capabilities. By its nature and common deployment pattern, this service is often configured to be reachable from the internet to allow remote users to connect to internal resources.

Remote Code Execution

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Microsoft Windows' Routing and Remote Access Service (RRAS). This flaw could allow an unauthorized remote attacker to execute malicious code on a victim's machine without any user interaction. The potential for widespread impact necessitates a clear understanding of its relevance to our environment.

Remote code execution flaw in Windows RRAS.
Critical severity; affects a core network service.
Confirm relevance and exposure of this service.

Attack Path

How an attacker could exploit the issue

An attacker could reach a vulnerable Windows Routing and Remote Access Service from the internet, as this service is often exposed externally to enable remote connections. By sending specially crafted requests to this service, an attacker could trigger a flaw that allows them to execute arbitrary code on the victim's machine without any prior privileges or user interaction. This could lead to unauthorized access and control over the compromised system.

Requires network exposure.
Triggered by crafted requests.
Risk of unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on a Windows machine by sending specially crafted requests to the Routing and Remote Access Service (RRAS). When supported, this could lead to a complete compromise of the affected system.

Unauthorized remote code execution.
Network-accessible service can be targeted.
Complete system compromise is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Windows Routing and Remote Access Service (RRAS) impacts systems exposed to network access, making it a concern for infrastructure, platform, and security teams. The immediate priority is to identify all instances of RRAS, confirm their external reachability and business criticality, and then assign an accountable owner for risk-based remediation planning.

Infrastructure and security teams own this.
Verify RRAS external reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Windows Routing and Remote Access Service (RRAS)?

RRAS is a Microsoft Windows component that manages network connectivity and VPN services. Organizations primarily use it to enable remote employees to securely access internal corporate networks and resources from outside locations. Because it acts as a gateway between external networks and internal infrastructure, it is a core service for remote connectivity.

What does CWE-122 mean in the context of CVE-2026-85809?

CWE-122 refers to a heap-based buffer overflow. In plain terms, this means the software incorrectly manages memory when processing incoming data. Because of this flaw in how CVE-2026-85809 interacts with system memory, an attacker can supply specifically crafted network requests that cause the service to crash or behave unexpectedly, eventually allowing them to execute their own unauthorized commands on the machine.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending malicious, specially crafted data requests over the network directly to the RRAS component. It is important to note that this does not require any human interaction, such as clicking a link or opening a file. If the service is running and reachable, simply sending the improper data sequence is sufficient to initiate the attack.

Is my system at risk if it runs RRAS?

The level of risk depends on your network configuration. According to Halo Surface Signal, because RRAS is designed to facilitate remote access, it is frequently configured to be reachable from the internet. Systems that are exposed to the public internet are at the highest risk, as they are directly addressable by remote attackers. If your RRAS instance is restricted to internal-only access, the attack surface is significantly reduced.

What should I do if I manage systems with this service?

Your first step is to locate all instances of RRAS across your environment to understand where this service is active. Once identified, verify whether those specific instances are reachable from the internet versus being confined to an internal network. After mapping your exposure, prioritize these systems for remediation based on their business criticality and current accessibility.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85809

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.