Summary
Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
An authenticated attacker with low-level access to an affected server could send a specially crafted request to execute code on the server. User interaction is not required.
Security updates
10.0.17763.9245 — https://support.microsoft.com/help/5122876
10.0.20348.5622 — https://support.microsoft.com/help/5122882
10.0.19044.7725 — https://support.microsoft.com/help/5122878
10.0.26100.33438 — https://support.microsoft.com/help/5122871
10.0.26200.9445 — https://support.microsoft.com/help/5124008
10.0.22631.7582 — https://support.microsoft.com/help/5122880
10.0.28000.2954 — https://support.microsoft.com/help/5124012
10.0.14393.9512 — https://support.microsoft.com/help/5123099
6.2.9200.26349 — https://support.microsoft.com/help/5123065
6.3.9600.23398 — https://support.microsoft.com/help/5123066
Vulnerabilities 1
-
High 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Revision history
-
#1
Information published.
References
-
CVE-2026-72950 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72950
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss