CVE-2026-72950: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Other sources
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The available CVSS vector indicates that exploitation is network-based, requires low attack complexity, requires low privileges, and does not require user interaction. The impact is rated high for confidentiality, integrity, and availability.
Which Windows systems are listed as affected?
The affected software list includes Windows 10, Windows 11, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025.
Does the provided information confirm whether RRAS is vulnerable in its default configuration?
No. The provided data identifies RRAS as the affected component but does not state whether the service must be enabled, configured, or exposed for exploitation.