Microsoft Releases Out-of-Band Hotpatch for Three Windows RRAS Remote Code Execution Vulnerabilities CVE-2026-25172/25173/26111
Microsoft issued an out-of-band hotpatch for Windows Routing and Remote Access Service (RRAS), fixing CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111. Integer overflow yields memory corruption; a low-privileged attacker can execute arbitrary code remotely. Enterprises should deploy immediately.
Microsoft released an out-of-band security update for three remote code execution bugs in Windows Routing and Remote Access Service (RRAS): CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111. Multiple national CERTs issued concurrent alerts. CVE-2026-26111 is integer-overflow memory corruption; successful exploit lets an attacker run arbitrary code and fully take over the host. Microsoft shipped a dedicated Windows 11 hotpatch. Enterprises should deploy outside the normal patch cycle.
Incident Overview
RRAS is the Windows Server component for routing, VPN dial-in, and remote-connection management—widely deployed as enterprise VPN gateways and remote-work infrastructure. The three bugs stem from mishandled network responses and memory structures. A low-privileged attacker can either lure a domain user into talking to a malicious RRAS server, or send crafted network requests to the RRAS management interface. ngCERT rates severity Critical (CVSS 8.0) with high exploit likelihood. Affected: Windows enterprise systems with RRAS enabled.
Technical Details
All three are memory-safety defects. CVE-2026-26111 is an integer overflow; the resulting memory corruption can be steered into controlled code execution. The other two involve mishandled network responses and broken resource lifetime management. The key exploit condition is low privilege: no SYSTEM or admin rights required—legitimate RRAS operations suffice for RCE. That sharply raises risk for RRAS exposed to the internet or reachable by any internal user. Post-exploit: full system control, then lateral movement.
Impact Assessment
RRAS commonly runs as a VPN and remote-access gateway—classic perimeter exposure. Network-level remote exploit plus Microsoft's choice to ship OOB outside Patch Tuesday signals a serious exploitation-risk judgment. A taken-over VPN gateway means the auth boundary is gone: attackers can steal domain credentials and forge legitimate remote access. Post-incident triage is far harder than a typical host compromise.
Remediation
- Install this OOB patch and hotpatch immediately via Windows Update or the Microsoft Update Catalog. Prioritize internet-exposed RRAS/VPN servers.
- Network restriction: limit RRAS access to trusted networks. Disable unused RRAS features.
- Segment the network and apply least privilege; shrink reachability of the RRAS management interface.
- Deploy IDS/IPS for anomalous requests against the RRAS management interface. Monitor VPN logons for odd hours, odd sources, and brute-force attempts.
- If MFA is not yet on, enable it for all remote access now. Cuts blast radius after exploit.
References
- ngCERT: Windows RRAS critical RCE advisory
- MSRC: CVE-2026-25172 advisory
- eSecurity Planet: Microsoft ships Windows 11 RRAS hotpatch