CVE‑2026‑62819: Remote Code Execution in Windows RRAS Service

Microsoft has disclosed a remote code execution vulnerability in the Routing and Remote Access Service (RRAS) that can be triggered by specially crafted network traffic. The flaw allows an unauthenticated attacker to execute arbitrary code with system privileges on any Windows Server that has RRAS enabled.

What happened

The vulnerability, identified as CVE‑2026‑62819, exploits a flaw in the RRAS packet parsing logic. Attackers can send a malformed packet to the RRAS service, causing a buffer overflow that leads to code execution.

Impact

• Windows Server 2012 R2, 2016, 2019, 2022 (all editions with RRAS enabled)
• Potential for full system compromise, lateral movement, data exfiltration
• High severity (CVSS 9.8)

What to do

• Apply the latest Microsoft security update for RRAS (KBxxxxxx).
• If the service is not required, disable RRAS or uninstall the feature.
• Restrict inbound traffic to RRAS ports (UDP/TCP 1723, GRE) using firewalls or network segmentation.
• Enable logging for RRAS and monitor for anomalous connection attempts.
• Consider implementing application whitelisting or endpoint protection to mitigate exploitation.

Microsoft recommends that administrators review the official advisory for detailed patch information and deployment guidance.