CVE-2026-85792

Executive Summary

CVE-2026-85792 is a critical (CVSS 9.8) remote code execution vulnerability in the Microsoft Windows Routing and Remote Access Service (RRAS), classified as a use-after-free (CWE-416). An unauthenticated, network-positioned attacker can trigger the flaw without user interaction to gain unauthorized access and execute code on the victim machine. No public proof-of-concept, exploit code, or vendor patch currently exists, and the CVE has not been added to CISA KEV or scored by FIRST.org EPSS; systems exposing RRAS are at elevated risk.

Technical Analysis

The vulnerability resides in the Windows Routing and Remote Access Service, a built-in Windows server role/component that provides routing, remote access VPN (including PPTP/L2TP/SSTP), and network address translation functionality. The root cause is a use-after-free (CWE-416): a memory object is released while a reference to it remains and is subsequently dereferenced. In a network-facing service such as RRAS, this class of defect typically arises during parsing or state management of incoming connection, negotiation, or control-plane traffic, where a freed buffer or session structure is reused.

Per the supplied data, the NVD description states only: "Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine." No function names, API endpoints, protocol fields, file paths, or internal structures are provided. Consequently, the precise triggering packet, affected code path, and memory object cannot be specified without fabrication. What can be stated with confidence, derived from the CVSS vector and CWE:

• Attack Vector: Network (AV:N) — the flaw is reachable remotely over the network.
• Attack Complexity: Low (AC:L) — no specialized conditions or race window are indicated.
• Privileges Required: None (PR:N) — no authentication is needed.
• User Interaction: None (UI:N) — no victim action required.
• Scope: Unchanged (S:U) — impact is confined to the vulnerable component's security authority.
• Confidentiality / Integrity / Availability: High/High/High (C:H/I:H/A:H) — full compromise of the affected system's data, code, and availability.

The attack surface is any Windows host with RRAS enabled and reachable — most commonly edge/remote-access servers, VPN concentrators, and multi-homed routing hosts. Because RRAS binds to network interfaces and processes inbound connection/negotiation traffic, the use-after-free is presumed to be triggerable through malformed or crafted network input during service processing. Insufficient technical detail is available to define the exact object lifecycle (allocation, free, reuse) or the input format that induces it.

The unauthenticated, low-complexity, network nature of the defect, combined with its RCE potential, places it in the highest severity band. Absent a vendor patch, exploitation would likely persist until Microsoft issues a security update or operators disable or isolate the service.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class (use-after-free causing RCE in a network service) and the CVSS characteristics. No specific function names, endpoints, or parameters are asserted because none are present in the source data.

1. Reconnaissance / target identification: An attacker scans for hosts exposing RRAS-related services. Externally reachable remote-access/routing endpoints (e.g., VPN listeners) are prioritized. Because the flaw is unauthenticated (PR:N) and requires no user interaction (UI:N), the attacker only needs network reachability to a listening RRAS interface.

2. Triggering the flaw: The attacker sends crafted network traffic to the RRAS listener designed to reach the vulnerable parsing/state-handling path. The goal is to cause a memory object to be freed while a lingering reference remains (the use-after-free condition). Successful triggering of a UAF typically manifests as a service crash, memory corruption, or controlled dereference. The specific packet structure/protocol field required is not disclosed in the available data and cannot be enumerated here.

3. Payload / execution (vulnerability-class level): Following the dangling-reference dereference, the attacker attempts to influence the freed/reallocated memory contents to redirect execution. In classic UAF-to-RCE exploitation, the attacker grooms allocations so the reused region contains attacker-influenced data, then hijacks a control-flow pointer or function dispatch. At this class level, the outcome is arbitrary code execution in the context of the RRAS service — historically a highly privileged Windows service, which raises the impact to full system control.

4. Post-exploitation impact: Per the CVSS subscores, the attacker achieves high confidentiality, integrity, and availability impact within the vulnerable component's authority. In practice, code execution as the RRAS service would enable unauthorized access to the victim machine, data theft, persistence, lateral movement into the internal network (RRAS hosts are often network chokepoints), and service disruption. The phrase "gain an unauthorized access to victim's machine" in the description is consistent with either full code execution or privileged service-context access.

Because no exploit is public, the practical attack chain beyond the vulnerability class remains theoretical. Defenders should treat any anomaly in RRAS process behavior (crashes, unexpected child processes, network egress) as a potential exploitation signal.

Impact Assessment

The vulnerability carries a maximum base score of 9.8 (Critical), reflecting a network-reachable, unauthenticated, no-interaction remote code execution. The Impact Sub-Score components (C:H/I:H/A:H) indicate a total loss of confidentiality, integrity, and availability of the affected system, with exploitability metrics (AV:N/AC:L/PR:N/UI:N) indicating trivial reachability.

Business impact is severe: RRAS is a Windows routing/VPN role frequently deployed at network perimeters and on multi-homed hosts acting as gateways between untrusted and trusted zones. Compromise of such a host can:

• Expose internal network segments through lateral movement from a chokepoint.
• Enable interception or manipulation of VPN/routing traffic (integrity + confidentiality impact).
• Provide a foothold for persistence and credential access on a high-value server.
• Cause denial of service if the UAF crashes the service (availability high).

Blast radius depends directly on deployment: a perimeter RRAS/VPN gateway extends impact to all downstream networks it routes or terminates. Systems with RRAS disabled or unreachable from untrusted networks are not exposed through this vector. Because no patch exists (patch confidence 0/4), the exposed population remains at risk until mitigations are applied. There is no EPSS score (not yet scored by FIRST.org) and no KEV listing, so urgency must be derived from the CVSS severity and the unpatched status rather than from observed in-the-wild activity, which is currently undetermined.

Detection Guidance

Sigma Rule

title: Suspicious Windows RRAS Service Crash or Unexpected Process Spawn
id: 5c2f9b7e-3a41-4d18-9f6a-8b1e7c4d2a55
status: experimental
description: Detects potential exploitation of CVE-2026-85792 (use-after-free RCE in Windows Routing and Remote Access Service) via service crashes or unexpected child processes of the RRAS service.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85792
author: valtersit.com
date: 2026-01-01
logsource:
  product: windows
  service: application
detection:
  selection_crash:
    Provider_Name: 'Application Error'
    Message|contains:
      - 'RemoteAccess'
      - 'rras'
      - 'Remote Access Connection Manager'
  selection_process:
    EventID: 4688
    ParentImage|endswith:
      - '\svchost.exe'
    CommandLine|contains:
      - 'RemoteAccess'
  filter_legit:
    CommandLine|contains: 'svchost.exe -k netsvcs'
  condition: selection_crash or (selection_process and not filter_legit)
falsepositives:
  - Legitimate RRAS service restarts or administrative troubleshooting
level: high

YARA Rule

rule CVE_2026_85792_RRAS_UAF_Indicator
{
    meta:
        description = "Heuristic detection for artifacts related to CVE-2026-85792 RRAS use-after-free exploitation"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85792"
        severity = "critical"
    strings:
        $s1 = "Remote Access Connection Manager" ascii nocase
        $s2 = "rras" ascii nocase
        $s3 = "Routing and Remote Access" ascii nocase
    condition:
        uint16(0) == 0x5A4D and any of ($s*) and filesize < 50MB
}

Suricata IDS Rule

alert tcp any any -> any 1723 (msg:"CVE-2026-85792 Windows RRAS Potential Use-After-Free Exploitation Attempt (PPTP)"; flow:to_server,established; content:"|01|"; offset:0; depth:1; threshold: type both, track by_src, count 10, seconds 60; classtype:attempted-admin; reference:cve,2026-85792; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85792; sid:202685792; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5m
  [ process where event.type == "start" and process.parent.name == "svchost.exe" and process.name : "svchost.exe" ]
  [ process where event.type == "start" and process.parent.name == "svchost.exe" and process.command_line : "*RemoteAccess*" ]

Splunk SPL Query

index=windows (source="XmlWinEventLog:Application" OR source="WinEventLog:Application")
| where (Provider_Name="Application Error" AND (Message="*RemoteAccess*" OR Message="*rras*" OR Message="*Remote Access Connection Manager*"))
    OR (EventCode=4688 AND ParentImage="*\\svchost.exe" AND CommandLine="*RemoteAccess*")
| stats count values(Message) as messages values(CommandLine) as cmds by host, EventCode, Provider_Name
| where count > 0

Wazuh OSSEC Rule

<group name="windows,cve-2026-85792,">
  <rule id="2026857" level="12">
    <if_sid>60000</if_sid>
    <field name="Provider_Name">Application Error</field>
    <field name="Message">RemoteAccess|rras|Remote Access Connection Manager</field>
    <description>CVE-2026-85792: Possible Windows RRAS service crash/exploitation attempt (use-after-free RCE)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85792,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, or version-specific remediation is available from any tracked source. The following guidance is generic hardening for an unpatched remotely reachable Windows service.

1. Immediate mitigations:

• Reduce exposure: block inbound access to RRAS/VPN listeners from untrusted networks using host and perimeter firewalls. If RRAS is not required, disable the role/service entirely.
• Segment RRAS hosts into a dedicated management/edge zone so that compromise does not directly reach internal subnets.
• Enforce least-privilege and restrict the RRAS service to essential operators.
• Monitor aggressively: alert on RRAS service crashes, unexpected child processes, and anomalous egress from RRAS hosts (see Detection Guidance). A use-after-free often surfaces first as a service crash.
• Apply virtual patching / IPS signatures at the network boundary where feasible to filter malformed traffic to exposed listeners.

2. Patch / upgrade steps:

• No patch exists as of this report. Monitor the Microsoft Security Update Guide for a fix referencing CVE-2026-85792. Once released, test and deploy promptly to all RRAS-enabled hosts, prioritizing internet-facing/perimeter systems.
• Track vendor advisories and the NVD entry for status changes, including any CISA KEV addition (currently NOT in KEV).

3. Long-term hardening:

• Remove or disable unused Windows roles/features; keep the attack surface minimal.
• Enforce network access controls and authentication on remote-access endpoints; prefer modern, strongly authenticated VPN protocols.
• Maintain an inventory of RRAS-enabled hosts to rapidly target mitigations or future patches.
• Adopt continuous vulnerability monitoring and rapid emergency-change procedures for perimeter services.

References

• NVD — CVE-2026-85792: https://nvd.nist.gov/vuln/detail/CVE-2026-85792
• CWE-416 (Use After Free): https://cwe.mitre.org/data/definitions/416.html
• CISA Known Exploited Vulnerabilities Catalog (currently no entry for CVE-2026-85792): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST.org EPSS (not yet scored): https://www.first.org/epss
• Microsoft Security Update Guide (monitor for RRAS fix): https://msrc.microsoft.com/update-guide

No public PoC, exploit code, Nuclei template, threat actor campaign, or exploit-in-the-wild evidence is currently associated with CVE-2026-85792 based on the provided data.