CVE-2026-85792

9.8Critical

Published 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-416

Impact

Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges on vulnerable hosts. They only need network access to the exposed Routing and Remote Access Service (RRAS).

Root cause

A use-after-free memory flaw (CWE-416) in the Routing and Remote Access Service leads to arbitrary code execution.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Install the official security update from Microsoft's MSRC advisory; if unable to patch immediately, disable the Routing and Remote Access Service (RemoteAccess) or block inbound traffic to it.

shell

$ Stop-Service -Name RemoteAccess -PassThru | Set-Service -StartupType Disabled

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85792Vendor AdvisoryPatch

Source: nvd.nist.gov/vuln/detail/CVE-2026-85792