by Kastro
Paper/Archive/CVE-2026-85809

CVE-2026-85809

Microsoft Windows 10 Version 1607 — Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.4.604 × 2012.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

Affected

ProductAffectedFixed inSource
Windows 10 Version 160710.0.14393.0 – < 10.0.14393.961210.0.14393.9612CNA
Windows 10 Version 180910.0.17763.0 – < 10.0.17763.937610.0.17763.9376CNA
Windows 10 Version 21H210.0.19044.0 – < 10.0.19044.780710.0.19044.7807CNA
Windows 10 Version 22H210.0.19045.0 – < 10.0.19045.780710.0.19045.7807CNA
Windows 11 version 23H210.0.22631.0 – < 10.0.22631.765210.0.22631.7652CNA
Windows 11 Version 23H210.0.22631.0 – < 10.0.22631.765210.0.22631.7652CNA
Windows 11 Version 24H210.0.26100.0 – < 10.0.26100.971110.0.26100.9711CNA
Windows 11 Version 25H210.0.26200.0 – < 10.0.26200.971110.0.26200.9711CNA
Windows 11 version 26H110.0.28000.0 – < 10.0.28000.323110.0.28000.3231CNA
Windows 11 Version 26H210.0.26300.0 – < 10.0.26300.971110.0.26300.9711CNA
Windows Server 20126.2.9200.0 – < 6.2.9200.264346.2.9200.26434CNA
Windows Server 2012 (Server Core installation)6.2.9200.0 – < 6.2.9200.264346.2.9200.26434CNA

Scores by source

microsoft (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchmsrc.microsoft.com/update-guide/vulnerability/CVE-2026-85809