CVE-2026-72959

CVE-2026-72959 is a heap-based buffer overflow (CWE-122) in Windows' Routing and Remote Access Service (RRAS) that can lead to remote code execution. It is triggered by sending crafted network traffic to the RRAS service on an affected host; per the CVSS vector, exploitation is network-based with low attack complexity, requires only low-privileged (authenticated) credentials, and needs no user interaction. A successful attacker gains the ability to execute code on the victim's machine and obtain unauthorized access, with high impact on confidentiality, integrity, and availability. Affected systems are Windows hosts with the RRAS role/service enabled, most commonly servers acting as VPN/remote-access gateways or routers. The flaw was disclosed in Microsoft's September 2026 Patch Tuesday; it is not yet in CISA KEV, no public proof-of-concept is known, and EPSS estimates only a 0.9% chance of exploitation within 30 days, so exploitation is plausible but not yet widely observed.

What to do: Apply the September 2026 Microsoft security updates (Patch Tuesday) as soon as possible on any Windows machine with the Routing and Remote Access role/service enabled. Inventory for RRAS in use (e.g., servers terminating VPN connections or acting as routers), restrict RRAS/VPN ports to trusted networks via firewall rules, and monitor Microsoft's advisory for the confirmed list of affected Windows versions.