{"id":"CVE-2026-70158","published":"2026-10-13T19:19:29.210","lastModified":"2026-10-16T16:20:38.843","description":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-415"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70158","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"CVE-2026-70158 is a remote code execution vulnerability in Windows Routing and Remote Access Service (RRAS) that allows attackers to execute arbitrary code on affected systems with high severity. This flaw is particularly concerning because RRAS is commonly used for VPN and network routing services, making it a prime target for lateral movement and persistent access.","exploitability":"Exploitation appears moderately difficult as it likely requires authentication privileges (PR:L) and network access to the RRAS service, but could be automated once initial access is gained through other means.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full control over affected Windows systems running RRAS, potentially enabling them to establish persistent backdoors, perform lateral movement, or exfiltrate sensitive data across the network.","remediation":"Disable RRAS service on non-essential systems or restrict network access to RRAS endpoints using firewall rules until a patch is available from Microsoft.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","windows","remote-access","network"],"model":"garnet-coder","analyzedAt":"2026-10-18T09:55:23.781Z"}}