{"id":"CVE-2026-85339","published":"2026-10-13T19:20:56.743","lastModified":"2026-10-16T16:21:54.827","description":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-122","CWE-191"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85339","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A memory corruption vulnerability in Windows RRAS allows remote attackers to execute arbitrary code on affected systems with high severity impact. This flaw enables unauthorized access and potential full system compromise.","exploitability":"Exploitation requires a remote attacker with network access to the RRAS service, which is typically exposed on TCP port 1723 for PPTP connections, making it moderately difficult to exploit without prior reconnaissance.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full control of Windows systems running RRAS, potentially leading to widespread network compromise and lateral movement throughout the affected organization.","remediation":"Disable the RRAS service on systems that do not require remote access functionality, or upgrade to Windows Server 2019 version 1809 or later with the latest security updates installed.","detection":"Monitor for unusual network traffic patterns on TCP port 1723, particularly malformed PPTP packets, and check Windows Event Logs for RRAS service errors or connection failures that may indicate exploitation attempts.","tags":["rce","windows","remote-access","network-service"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:00:14.025Z"}}