{"id":"CVE-2026-85809","published":"2026-10-13T19:21:05.287","lastModified":"2026-10-16T19:38:42.970","description":"Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-122"],"vendors":["microsoft"],"products":["windows 10 1607","windows 10 1809","windows 10 21h2","windows 10 22h2","windows 11 23h2","windows 11 24h2","windows 11 25h2","windows 11 26h1","windows 11 26h2","windows server 2012","windows server 2016","windows server 2019"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85809","tags":["Vendor Advisory","Patch"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The vulnerability is a heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) that allows remote attackers to execute arbitrary code with system-level privileges. This flaw is particularly dangerous because it can be exploited without authentication, giving attackers full control over affected systems.","exploitability":"Exploitation is relatively straightforward as it requires only network access to the RRAS service, with no authentication needed, though the target must have RRAS enabled and accessible over the network.","blast_radius":"The impact could be severe across enterprise networks since RRAS is commonly used for remote access solutions, potentially allowing attackers to pivot through multiple systems and establish persistent access to critical infrastructure.","remediation":"Disable RRAS service on all affected Windows systems until a patch is available, or restrict network access to RRAS endpoints using firewall rules to limit exposure to trusted networks only.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","remote-access","windows","network-service"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:50:26.178Z"}}