CVE-2026-20843 Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability

Api.Msrc.Microsoft • January 13, 2026

Share: View original

Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in Windows RRAS: Remote Code Execution and Elevation of Privilege Two vulnerabilities have been identified in Windows Routing and Remote Access Service (RRAS). CVE-2026-20868 allows unauthorized remote code execution via a heap-based buffer overflow, while CVE-2026-20843 enables authorized users to elevate their privileges locally due to improper access control. 2 sources 58

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

Platforms (1)

Vulnerabilities (1)

RRAS Elevation Of Privilege Vulnerability