Skip to content
OpenAdvisories
High MSRC-CVE-2025-64678 1 CVE

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Published Dec 9, 2025 · Updated Jan 14, 2026 · Revision 2

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker authenticated on the domain could exploit this vulnerability by tricking a domain-joined user into sending a request to a malicious server via the Routing and Remote Access Service (RRAS) Snap-in. This could result in the server returning malicious data that might cause arbitrary code execution on the user's system.

Security updates
10.0.17763.8027 — https://support.microsoft.com/help/5068791
10.0.20348.4405 — https://support.microsoft.com/help/5068787
10.0.20348.4346 — https://support.microsoft.com/help/5068840
10.0.19044.6575 — https://support.microsoft.com/help/5068781
10.0.26100.7171 — https://support.microsoft.com/help/5068861
10.0.26100.7092 — https://support.microsoft.com/help/5068966
10.0.22631.6199 — https://support.microsoft.com/help/5068865
10.0.25398.1965 — https://support.microsoft.com/help/5068779
10.0.14393.8594 — https://support.microsoft.com/help/5068864
6.0.6003.23624 — https://support.microsoft.com/help/5068906
6.0.6003.23624 — https://support.microsoft.com/help/5068909
6.1.7601.28021 — https://support.microsoft.com/help/5068904
6.1.7601.28021 — https://support.microsoft.com/help/5068908
6.2.9200.25768 — https://support.microsoft.com/help/5068907
6.3.9600.22869 — https://support.microsoft.com/help/5068905

Vulnerabilities 1

Revision history

  1. #2

    Updated the build numbers. This is an informational update only.

  2. #1

    Information published. This CVE was addressed by updates that were released in November 2025, but the CVE was inadvertently omitted from the November 2025 Security Updates. This is an informational change only. Customers who have already installed the November 2025 update do not need to take any further action.

References