CVE-2026-26111

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.

Affected

Microsoft · Windows 10 Version 1607 · Windows 10 Version 1809 · Windows 10 Version 21H2 · Windows 10 Version 22H2 · Windows 11 version 22H3 · Windows 11 Version 23H2

CVSS v3.1 MICROSOFT

8.0 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

0.80% chance of exploitation in the next 30 days, 56th percentile

Published

2026-03-10

Updated

2026-06-19

Proof-of-concept exploits (1)

• Dhananjayasj/RRAS-VULNERABILITY-CVE-2026-25172-CVE-2026-25173-CVE-2026--261110★ · 2026-05-30

Security advisories

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26111

References

• CVE Record
• NVD entry

Related

• CVE-2024-1698
• CVE-2024-21413
• CVE-2024-6624
• CVE-2025-24813
• CVE-2026-25172
• CVE-2026-25173