CVE-2026-26111 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Api.Msrc.Microsoft • March 10, 2026

Share: View original

Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affect Windows RRAS with Remote Code Execution Vulnerabilities Three critical vulnerabilities have been identified in the Windows Routing and Remote Access Service (RRAS), allowing both unauthorized and authorized attackers to execute code over a network. CVE-2026-25172 and CVE-2026-26111 enable unauthorized access, while CVE-2026-25173 permits authorized attackers to exploit the same weakness. All three vulnerabilities were published on March 10, 2026. 14 sources 72

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

MITRE ATT&CK (1)

T1190 - Exploit Public-Facing Application

Platforms (1)